EP3955510B1 - Communication system with multi-stage security concept - Google Patents

Communication system with multi-stage security concept Download PDF

Info

Publication number
EP3955510B1
EP3955510B1 EP20191225.0A EP20191225A EP3955510B1 EP 3955510 B1 EP3955510 B1 EP 3955510B1 EP 20191225 A EP20191225 A EP 20191225A EP 3955510 B1 EP3955510 B1 EP 3955510B1
Authority
EP
European Patent Office
Prior art keywords
key
endpoints
communication system
bit
quantum
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP20191225.0A
Other languages
German (de)
French (fr)
Other versions
EP3955510A1 (en
Inventor
Ralf-Peter Braun
Marc Geitz
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Deutsche Telekom AG
Original Assignee
Deutsche Telekom AG
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Deutsche Telekom AG filed Critical Deutsche Telekom AG
Priority to EP20191225.0A priority Critical patent/EP3955510B1/en
Publication of EP3955510A1 publication Critical patent/EP3955510A1/en
Application granted granted Critical
Publication of EP3955510B1 publication Critical patent/EP3955510B1/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography

Definitions

  • the invention relates to a multi-level, ie at least two-level, security concept for the transmission of user data in a communication system consisting of two end points and a data connection connecting these two end points with one another.
  • the security concept and thus the invention relate to the encryption of user data transmitted between the two end points, ie to the security of this encryption.
  • Objects of the invention are a method which is based on an at least two-stage security concept with regard to the encryption of the user data mentioned, and a communication system designed to carry out this method.
  • the invention relates to a communication system in which the two end points connected to one another by the data connection are two network nodes in a network that may, ie typically, includes further network nodes.
  • the invention is not limited to this. Rather, the end points can be a wide variety of telecommunications devices, systems or parts thereof between which user data is exchanged, for example devices within a network node.
  • the end points of modern communication systems such as network nodes of telecommunications networks, are regularly equipped with encryption and decryption devices which, for the sake of simplicity, are also referred to below as encryptors.
  • the relevant devices the data to be transmitted are encrypted before they are sent by the sending endpoint according to a method implemented for this purpose in the endpoint and after transmission they are decrypted again at the receiving endpoint using the same method, i.e. in a corresponding manner.
  • the public key method was originally developed for this purpose in particular, in which a key generated by a participant, for example a first endpoint, is matched with a public key of the other participant intended to receive this generated key, i.e. the one intended for reception endpoint, is encrypted and can be recovered after transmission on the receiving side by decrypting the received bit sequence with the recipient's private key.
  • public key procedures such as in the Transmission of e-mails, also used for direct encryption and decryption of user data.
  • AES Advanced Encryption Standard
  • Twofish-256 Twofish-256.
  • EP3267619 describes a method of failover in a network.
  • Quantum keys quantum-secure keys
  • encryption techniques which are also considered secure, i.e. unbreakable, also with regard to a possible attack with quantum computers currently under development.
  • quantum keys quantum-secure keys
  • the technical systems required for this are very expensive, complex and expensive. In this respect, with regard to the use of such systems, a trade-off must always be made between what is feasible using the corresponding technology and the costs incurred for this.
  • the object of the invention is to provide a solution for a flexible security concept relating to the transmission of user data in a communication system.
  • a corresponding method must be specified for this and a communication system designed to carry out the method must be provided.
  • the security concept mentioned at the beginning relates to the operation of a communication system consisting of two end points and a data connection between these end points.
  • the invention preferably (but not necessarily and in this respect also not restrictively) relates to a method which is used for a communication system in which the end points connected to one another by the data connection are two network nodes in a network.
  • the addressed end points of the communication system can also be components within a network node that are connected to one another, for example.
  • the method proposed for the solution assumes that user data exchanged between the first endpoint and the second endpoint of the aforementioned communication system are encrypted symmetrically.
  • the symmetrical encryption of the user data is carried out using a key present in the two endpoints, which is based on a random number generated in the first endpoint and transmitted to the second endpoint as a shared secret according to the public-key method.
  • the aforementioned random number i.e. the shared secret itself exchanged between the endpoints according to the public key method
  • the user data is symmetrically encrypted using a key that is formed by a bit-by-bit XOR combination of the basic key with an additional key present in both end points , which is a quantum key, i.e. a key generated using a quantum-secure method.
  • the method is also designed in such a way that the communication system automatically reverts to basic operation if it is used in the aforementioned comfort mode and a fault occurs, in which the user data is encrypted directly using the public-key method exchanged as Base key serving random number takes place.
  • the communication system is based on an at least two-stage security concept, with other aspects provided in particular according to corresponding refinements and developments of the method, depending on the point of view, also being regarded as a further security level of this concept.
  • the term "comfort mode" for the operating mode in which the user data is encrypted using a key generated by bitwise XORing the basic key with an additional key is basically arbitrary and is used in the further representations only for linguistic purposes Simplification. This designation is arbitrary insofar as, depending on the configuration and arrangement of the communication system in question in an overall system (network), this operating mode can also be a regular operation of the communication system. The latter can be the case, for example, in particular if the communication system under consideration is part of the core network of a wide area network maintained by a provider. Encryption with a higher level of security will then be used regularly, i.e.
  • a communication system works as it were by default in the addressed basic operation, in which the user data is encrypted directly using the key (the exchanged random number) exchanged using the public key method. Provision can then also be made for the very security-conscious user or a user with fundamentally higher security requirements to be given the option of using the communication system in the more secure operating mode referred to as "comfort mode" in the context of a chargeable, additionally bookable option to use a key created by XOR linking a basic key and an additional key. A few comments will be made later on how the latter, i.e. the question of adding comfort mode, can be implemented.
  • each key or each bit sequence serving as a key is preferably only used once.
  • the use of the corresponding key as a one-time pad is particularly preferred, with the relevant key having the same bit length as the block of user data to be transmitted in a transmission process.
  • patent claim 1 includes the possibility of continuously exchanging keys according to the public key principle between the end points of the communication system, which in basic operation are used directly to encrypt user data or in comfort operation to form the keys used to encrypt user data Bit sequence are used.
  • endpoints mentioned above can be a wide variety of telecommunications devices, systems or parts thereof between which user data is exchanged, for example also network nodes of a network or devices within such network nodes.
  • the method is designed according to a preferred embodiment in such a way that the additional key used for the bitwise XOR link with the basic key is one of several quantum keys present in both endpoints.
  • an identifier is also exchanged between the end points, which uniquely designates the additional key (quantum key) to be used for the XOR link with the basic key, as mentioned, present in both end points.
  • This identifier can be transmitted, for example, together with the shared secret transmitted using the public key method, i.e. together with the exchange of the basic key, or also in a separate transmission process.
  • the security concept according to the invention offers at least two-stage security concept with the basic operation, even in the event of a fault in the systems providing the additional keys in the form of quantum keys or in the event that not enough additional keys are available, to be able to provide at least a minimum level of security when encrypting user data, in particular with regard to data traffic on layer 1, layer 2 or layer 3 of the OSI layer model.
  • the invention is therefore based on the consideration of enabling an operating mode (comfort mode) with very high security with regard to the encryption of the user data for particularly security-sensitive areas, such as core networks, or if desired, for an additional charge, but in the event that this operating mode is not is available to enable at least basic operation with a high degree of security.
  • quantum keys i.e. keys generated using quantum mechanical methods or encryption methods based on quantum effects
  • PQC encryption methods there is no corresponding proof for PQC encryption methods.
  • the latter are encryption methods that are based on very complex algorithms for which - as of now - it is assumed that they, too, can withstand an attack with quantum computers. In any case, no proof to the contrary has been provided so far.
  • the basic operation basically offers the same level of security as one performed using keys generated by quantum mechanics comfort mode.
  • the use of the invention provides double security, so to speak, within the framework of which the basic operation basically represents a kind of security redundancy.
  • quantum key security can be provided at the user level independently of the provider level (provider-specific level), where the user could also bring in their own key that would not be visible to the provider.
  • the method is preferably also designed so that the endpoints mutually prior to the exchange of the shared secret using a Authenticate PQC signature process.
  • the Endpoints For example, before exchanging the shared secret, they can exchange a mutually known message, which they provide using their unique signature generated using a PQC signature process.
  • PQC encryption methods are regularly used in combination with corresponding PQC signature methods used for authentication, so that both forms of implementation - replacement of the basic key by PQC encryption and authentication by PQ signing methods - actually belong together .
  • a respective additional key i.e. the quantum key used for the bitwise XOR operation with the basic key
  • the two appropriately designed end points e.g. network nodes
  • a QKD method e.g. the quantum key used for the bitwise XOR operation with the basic key
  • the comfort mode can be provided as an additional option that is subject to a charge, for example by retrofitting QKD systems in the two end points.
  • the end points already have corresponding QKD systems, which are only actively integrated if comfort mode is used.
  • a method design is also possible in which the two endpoints of the communication system are not in a QKD relationship with one another, but are each connected to two other endpoints forming a QKD network via at least two completely disjoint connection paths.
  • the end points of the communication system that are not in a QKD relationship with each other are provided with the quantum keys that can be used as additional keys for carrying out the comfort operation according to a special method, so to speak, as QKD as a Service (QaaS).
  • QaaS QKD as a Service
  • the quantum key serving as an additional key is made available to the two end points of the communication system by the QKD network by means of a transmission method in which the QKD network sends several quantum keys formed by bitwise XOR linking generated by the QKD network to both end points of the Communication system are transmitted via one of the disjoint connection paths. At least one of the aforementioned bit sequences generated by bitwise XORing of quantum keys is formed including the additional key to be delivered to the end points of the communication system considered here within the scope of the invention.
  • the two endpoints can extract this additional key from the bit sequences they receive via the two disjoint connection paths by XORing together all the bit sequences they receive for the transmission of this additional key.
  • This method makes it possible in a particularly advantageous manner to provide both endpoints of the communication system considered here for the bitwise XOR operation with the base key as an additional key to be used as an additional key, without the endpoints themselves being in a QKD relationship with one another or by other means to generate quantum keys.
  • this variant is particularly well suited to making the comfort mode available to the communication system, if necessary as an additional option that is subject to a charge.
  • the method described can be used in systems on different layers of the OSI layer model, for example on layer 1 (physical layer), layer 2 (data link layer) or layer 3 (IP network layer) in order to provide quantum-safe protection for the corresponding systems.
  • layer 1 physical layer
  • layer 2 data link layer
  • layer 3 IP network layer
  • OTN Optical Transport Network
  • the encryption is independent of protocols or applications. There is no protocol overhead with Layer 1 encryption, so the full bandwidth of the media can be used.
  • Layer 2 encryptors allow secure transmission of, for example, unicast, multicast or broadcast data, for example in Ethernet systems.
  • Layer 2 encryption is completely decoupled from all applications at higher levels and, thanks to the low overhead, provides significant speed advantages over Layer 3 encryption.
  • Layer 3 IP encryptors allow data to be transmitted that is secured, for example, via a virtual private network (VPN) connection. This allows secure networks that allow common IP address spaces and thus enable different applications to be protected in a quantum-safe manner. Layer 3 encryption generates the greatest overhead and is therefore associated with a loss of speed.
  • VPN virtual private network
  • the communication system can be operated in a basic mode and in a comfort mode, namely in an mode with increased security in relation to the encryption of the user data exchanged between the two endpoints.
  • its endpoints encrypt the user data exchanged between them with a base key generated by the first endpoint serving random number symmetrically.
  • the respective random number i.e. the respective basic key, is transmitted as a shared secret from the first endpoint that generates it using a PQC encryption method that can be executed by the endpoints, encrypted with the public key of the second endpoint, to the second endpoint, which in turn transmits this random number extracted from the sequence he received using his private key.
  • the endpoints of the communication system encrypt the user data exchanged between them using a key, which they generate by bitwise XORing the basic key exchanged between them with a quantum key (additional key) taken from their common stock and used identically in both endpoints.
  • the encryptors of both endpoints are each equipped with a PQC server for executing the aforementioned PQC encryption method and with a unit for bitwise XORing of bit sequences when executing comfort mode.
  • one possible embodiment of the communication system according to the invention is a communication system whose end points are formed by two network nodes, this communication system possibly also being part of a more comprehensive, multiplicity network having network nodes can be.
  • the network nodes of the communication system can be either two network nodes in a local network or two in different local networks, such as in two metro networks, or even in two continental networks, via one intercontinental data connection networks connected to each other - act arranged network nodes - to a certain extent as transition nodes.
  • both end points of the communication system have a QKD system.
  • the endpoints are in a QKD relationship with one another to generate the quantum key serving as an additional key, the generation of which takes place according to a QKD method, ie according to a method of quantum key distribution.
  • the end points of the communication system can advantageously generate the quantum-secure additional keys (quantum keys) used for the bit-by-bit XOR operation with a respective base key.
  • the communication system according to the invention can also be advantageously further developed in that its first endpoint has a quantum random number generator QRNG for generating the random numbers to be used as the base key.
  • QRNG quantum random number generator
  • the most important advantage of the invention lies in the elimination of a vulnerability (possible use of basic keys without quantum security) in the implementation of encryption protocols with commercially available encryptors.
  • the solution presented is particularly applicable to all encryptors that operate on OSI Layer 1, Layer 2 or Layer 3.
  • the security of layer 1, layer 2 or layer 3 transmission systems is significantly increased in particular by the implementation of a preferred embodiment of the solution according to the invention, with the exchange of a self-quantum-secure base key using post-quantum cryptography (PQC).
  • PQC post-quantum cryptography
  • the QKD and PQC systems provide increased Security, whereby even in the event of a temporary failure of one of the two systems, quantum-secure communication is guaranteed for the entire system.
  • the solution presented can be integrated transparently and minimally invasively into QKD architectures.
  • the security of the invention presented depends directly on the security of the cryptographic methods used.
  • the theoretical security of the quantum key exchange has been proven and depends largely on the validity of the laws of quantum mechanics, while the practical security depends on the technical implementation of a respective QKD system and the possibilities of technical side channels.
  • PQC post-quantum encryption
  • QKD quantum key exchange
  • PQC Post Quantum Cryptography
  • QKD Quantum Key Exchange
  • the exemplary embodiment relates to a communication system in which the end points connected to one another by the data connection are network nodes within a network. The connections/connectivities of these two network nodes to other network nodes of the network were not shown.
  • the 1 shows a rough schematic representation of the communication system formed by two network nodes (first endpoint 1 and second endpoint 2) and a data link 3 connecting them to one another.
  • Both network nodes (endpoints 1, 2) each have an encryptor 4, 5, ie an encryption and decryption device for encrypted data traffic taking place via the data connection between the network nodes (endpoints 1, 2).
  • the encryptors 4, 5 of both network nodes (endpoints 1, 2) each have a PQC server, a local key memory 6, 7 for receiving common quantum keys, i.e. identical quantum keys in both network nodes (endpoints 1, 2), and local key management 8, 9 assigned to the management of the aforementioned quantum key or alternatively designed as an integral part of the respective encryptor 4, 5.
  • the network nodes In comfort operation, which can also be regular operation, in particular in the case of a communication system designed as part of a core network, the network nodes (endpoints 1, 2) encrypt the user data transmitted between them using a key which, by means of a bit-by-bit XOR link of a previously exchanged between them by means of a PQC encryption method with a quantum key (used identically in both network nodes, ie endpoints 1, 2) is generated from the shared store of both network nodes.
  • a key which, by means of a bit-by-bit XOR link of a previously exchanged between them by means of a PQC encryption method with a quantum key (used identically in both network nodes, ie endpoints 1, 2) is generated from the shared store of both network nodes.
  • the communication system works in this comfort mode or control mode.
  • the communication system immediately falls back into basic operation.
  • only the currently valid basic key is used to encrypt the data exchanged between the network nodes (endpoints 1, 2).
  • the latter is exchanged beforehand by the two network nodes (endpoints 1, 2) using a public key method, but in the present case using a particularly secure method, namely a PQC encryption method. The exchange takes place as follows.
  • the first network node (endpoint 1) would like to exchange user data with the second network node (endpoint 2) on one of layers 1, 2 or 3 of the OSI layer model. To do this, the two network nodes, i.e. their systems, first identify themselves with one another by using a PQC signature process. After successful authentication, the first network node (endpoint 1) encrypts a random number generated by it with the public key of the second network node (endpoint 2) received earlier and transmits the resulting bit sequence via data connection 3 to the second network node (endpoint 2). The second network node (endpoint 2) uses its private key to extract the random number generated by the first network node (endpoint 1) and transmitted as a shared secret from the bit sequence it has received.
  • this basic key is XORed bit by bit using a quantum key from the common stock of both network nodes (endpoints 1, 2) and the resulting bit sequence for symmetric encryption between the network nodes (endpoints 1, 2) of user data to be transmitted used.
  • the first network node (the first endpoint 1) transmits to the second network node (the first endpoint 2) an identifier of that quantum key from the shared store that it wants to use for bitwise XORing of the base key.
  • the second network node (endpoint 2), controlled by its local key management 9, searches for the quantum key designated by it, which is also available to it, from the local key memory 7 and, in turn, uses the encryptor 5 to XOR it bit by bit with the previously extracted by him from the data received from the first network node base key.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

Die Erfindung betrifft ein mehrstufiges, das heißt mindestens zweistufiges Sicherheitskonzept für die Übertragung von Nutzdaten in einem aus zwei Endpunkten und aus einer diese beiden Endpunkte miteinander verbindenden Datenverbindung bestehenden Kommunikationssystem. Das Sicherheitskonzept und somit die Erfindung beziehen sich auf die Verschlüsselung zwischen den beiden Endpunkten übertragener Nutzdaten, das heißt auf die Sicherheit dieser Verschlüsselung. Gegenstände der Erfindung sind ein Verfahren, welchem hinsichtlich der angesprochenen Verschlüsselung der Nutzdaten ein mindestens zweistufiges Sicherheitskonzept zugrunde liegt, sowie ein zur Durchführung dieses Verfahrens ausgebildetes Kommunikationssystem. Entsprechend einem bevorzugten Anwendungsfall bezieht sich die Erfindung auf ein Kommunikationssystem, bei welchem es sich bei den beiden durch die Datenverbindung miteinander verbundenen Endpunkten um zwei Netzwerkknoten in einem gegebenenfalls, das heißt typischerweise, noch weitere Netzwerkknoten umfassenden Netzwerk handelt. Jedoch ist die Erfindung hierauf nicht beschränkt. Vielmehr kann es sich bei den Endpunkten um unterschiedlichste telekommunikative Einrichtungen, Systeme oder Teile davon handeln, zwischen denen Nutzdaten ausgetauscht werden, so beispielsweise auch um Einrichtungen innerhalb eines Netzwerkknotens.The invention relates to a multi-level, ie at least two-level, security concept for the transmission of user data in a communication system consisting of two end points and a data connection connecting these two end points with one another. The security concept and thus the invention relate to the encryption of user data transmitted between the two end points, ie to the security of this encryption. Objects of the invention are a method which is based on an at least two-stage security concept with regard to the encryption of the user data mentioned, and a communication system designed to carry out this method. According to a preferred application, the invention relates to a communication system in which the two end points connected to one another by the data connection are two network nodes in a network that may, ie typically, includes further network nodes. However, the invention is not limited to this. Rather, the end points can be a wide variety of telecommunications devices, systems or parts thereof between which user data is exchanged, for example devices within a network node.

Der Sicherheit über Kommunikationsnetze, das heißt innerhalb von Kommunikationssystemen, zwischen Teilnehmern übertragener Daten kommt eine sehr große und im Hinblick auf dafür zu erfüllende Anforderungen noch stark wachsende Bedeutung zu. Dies gilt im Grunde für alle Arten von Daten, einschließlich für Daten, welche digital gewandelte Sprachnachrichten betreffen, aber auch für insoweit ebenfalls Daten darstellende Schlüssel, welche zwischen Teilnehmern zur späteren Verwendung für die Verschlüsselung der eigentlichen Nutzdaten und/oder für die Absicherung der zum Übertragen dieser Nutzdaten verwendeten Verbindungen dienen. Darüber hinaus kann es sich bei entsprechend zu sichernden Daten außerdem auch um Netzwerkmanagementdaten, Steuerdaten in einem Netzwerk oder um sonstige Netzwerkdaten beliebiger Art handeln.The security of data transmitted between participants via communication networks, ie within communication systems, is of very great importance, and in view of the requirements to be met for this purpose it is still growing in importance. This basically applies to all types of data, including data relating to digitally converted voice messages, but also to keys that represent data in this respect, which are exchanged between participants for later use to encrypt the actual user data and/or to secure the data to be transmitted connections used for this user data. In addition, there may be data to be backed up accordingly also be network management data, control data in a network or other network data of any kind.

Demgemäß sind die Endpunkte moderner Kommunikationssysteme, wie Netzwerkknoten von telekommunikativen Netzwerken, regelmäßig mit Ver- und Entschlüsselungseinrichtungen ausgestattet, welche nachfolgend, sprachlich vereinfachend, auch als Verschlüsseler bezeichnet werden sollen. Mittels der betreffenden Einrichtungen werden die zu übertragenden Daten vor ihrer Aussendung durch den sie aussendenden Endpunkt entsprechend einem dafür in dem Endpunkt implementierten Verfahren verschlüsselt und nach der Übertragung bei dem sie empfangenden Endpunkt unter Anwendung desselben Verfahrens, das heißt in korrespondierender Weise, wieder entschlüsselt.Accordingly, the end points of modern communication systems, such as network nodes of telecommunications networks, are regularly equipped with encryption and decryption devices which, for the sake of simplicity, are also referred to below as encryptors. Using the relevant devices, the data to be transmitted are encrypted before they are sent by the sending endpoint according to a method implemented for this purpose in the endpoint and after transmission they are decrypted again at the receiving endpoint using the same method, i.e. in a corresponding manner.

Marktübliche, gegenwärtig breit im Einsatz befindliche Verschlüsseler bedienen sich bei der Verschlüsselung von Daten häufig eines symmetrischen Verschlüsselungsverfahrens, für welches sie einen Schlüssel einsetzen, den die Endpunkte zuvor nach einem Public-Key-Verfahren (also asymmetrisch) als sogenanntes Shared Secret ausgetauscht haben. Hierbei ist anzumerken, dass ein wesentliches Problem bei der symmetrischen Verschlüsselung von Daten, also beim Einsatz eines Verschlüsselungsverfahrens, für welches zum Verschlüsseln der Daten derselbe Schlüssel verwendet wird wie zu deren Entschlüsselung an der empfangenden Stelle, die Frage eines sicheren Austauschs des insoweit verwendeten Schlüssels ist.Commercial encryptors that are currently in widespread use often use a symmetric encryption method for encrypting data, for which they use a key that the endpoints have previously exchanged using a public key method (i.e. asymmetric) as a so-called shared secret. It should be noted here that a major problem with the symmetrical encryption of data, i.e. when using an encryption method for which the same key is used to encrypt the data as for decrypting it at the receiving point, is the question of a secure exchange of the key used in this respect .

Insbesondere zu diesem Zweck wurde ursprünglich das Public-Key-Verfahren entwickelt, bei dem ein seitens eines Teilnehmers, beispielsweise eines ersten Endpunkts, generierter Schlüssel mit einem öffentlichen Schlüssel des für den Empfang dieses generierten Schlüssels bestimmten anderen Teilnehmers, das heißt des für den Empfang bestimmten Endpunkts, verschlüsselt wird und nach der Übertragung auf der empfangenden Seite wiederherstellbar ist durch Entschlüsselung der empfangenen Bitsequenz mit dem privaten Schlüssel des Empfängers. Im Einzelfall werden Public-Key-Verfahren, so beispielsweise bei der Übertragung von E-Mails, auch zur unmittelbaren Ver- und Entschlüsselung von Nutzdaten verwendet. Ein weit verbreitetes Verfahren ist dabei das Diffie-Hellman-Protokoll, welches häufig in Kombination mit einem der Authentifikation der beiden die Daten austauschenden Seiten dienenden RSA-Verfahren (RSA = Rivest, Shamir, Adleman) verwendet wird.The public key method was originally developed for this purpose in particular, in which a key generated by a participant, for example a first endpoint, is matched with a public key of the other participant intended to receive this generated key, i.e. the one intended for reception endpoint, is encrypted and can be recovered after transmission on the receiving side by decrypting the received bit sequence with the recipient's private key. In individual cases, public key procedures, such as in the Transmission of e-mails, also used for direct encryption and decryption of user data. A widespread method is the Diffie-Hellman protocol, which is often used in combination with an RSA method (RSA=Rivest, Shamir, Adleman) used to authenticate the two sides exchanging data.

Soweit ein Public-Key-Verfahren zum Austausch eines als Schlüssel dienenden Shared Secret verwendet wird, erfolgt im Nachgang der Austausch der eigentlichen Nutzdaten unter Verwendung dieses zuvor ausgetauschten Schlüssels durch Verschlüsselung nach einem symmetrischen Verschlüsselungsverfahren, wie beispielsweise AES-256 (AES = Advanced Encryption Standard) oder Twofish-256.If a public key method is used to exchange a shared secret that serves as a key, the actual user data is subsequently exchanged using this previously exchanged key by encryption using a symmetric encryption method such as AES-256 (AES = Advanced Encryption Standard ) or Twofish-256.

EP3267619 beschreibt ein Verfahren zur Herstellung einer Ausfallsicherung in einem Netzwerk. EP3267619 describes a method of failover in a network.

Die beiden vorgenannten symmetrischen Verschlüsselungsverfahren gelten dabei als sicher. Indes besteht ein Risiko bei der zuvor beschriebenen Vorgehensweise bei der Übertragung eines hierfür verwendeten Schlüssels darin, dass der nach dem Public-Key-Verfahren ausgetauschte, später für die symmetrische Verschlüsselung der Nutzdaten verwendete Schlüssel, zum Beispiel durch einen Man-in-the-Middle-Angriff, abgefangen werden und somit die nachfolgend verschlüsselt übertragenen Nutzdaten abgehört werden könnten.The two aforementioned symmetric encryption methods are considered secure. However, there is a risk with the procedure described above when transmitting a key used for this purpose, that the key exchanged according to the public key method and later used for the symmetrical encryption of the user data, for example by a man-in-the-middle attack, can be intercepted and the user data subsequently transmitted in encrypted form could be intercepted.

Neuere Verschlüsselungstechniken beruhen auf der Verwendung quantensicherer Schlüssel (Quantenschlüssel), das heißt von Schlüsseln und Verschlüsselungstechniken, welche auch im Hinblick auf einen möglichen Angriff mit gegenwärtig in Entwicklung befindlichen Quantencomputern als sicher, also als nicht zu brechen gelten. Allerdings sind die hierfür erforderlichen technischen Systeme sehr aufwendig, komplex und teuer. Insoweit wird im Hinblick auf den Einsatz derartiger Systeme immer auch eine Abwägung zu treffen sein, zwischen dem mittels der entsprechenden Technik Machbaren und den dafür entstehenden Kosten.Newer encryption techniques are based on the use of quantum-secure keys (quantum keys), i.e. keys and encryption techniques which are also considered secure, i.e. unbreakable, also with regard to a possible attack with quantum computers currently under development. However, the technical systems required for this are very expensive, complex and expensive. In this respect, with regard to the use of such systems, a trade-off must always be made between what is feasible using the corresponding technology and the costs incurred for this.

Vor diesem Hintergrund ist zu erwarten, dass der Einsatz entsprechender Technik, also insbesondere von Systemen, welche sich bei der Schlüsselerzeugung quantenmechanischer Effekte bedienen, Bereichen mit sehr hohen speziellen Sicherheitsanforderungen, wie beispielsweise den Kernnetzen von Telekommunikationsunternehmen, oder aber zahlungskräftigen Kunden mit einem erhöhten Sicherheitsbedürfnis vorbehalten bleiben wird.Against this background, it can be expected that the use of appropriate technology, i.e. in particular systems that use quantum mechanical effects to generate keys, will be reserved for areas with very high special security requirements, such as the core networks of telecommunications companies, or for wealthy customers with an increased need for security will stay.

Aufgabe der Erfindung ist es, betreffend die Übertragung von Nutzdaten in einem Kommunikationssystem, eine Lösung für ein flexibles Sicherheitskonzept zur Verfügung zu stellen. Hierfür sind ein entsprechendes Verfahren anzugeben und ein zur Durchführung des Verfahrens ausgebildetes Kommunikationssystem bereitzustellen.The object of the invention is to provide a solution for a flexible security concept relating to the transmission of user data in a communication system. A corresponding method must be specified for this and a communication system designed to carry out the method must be provided.

Die Aufgabe wird durch ein Verfahren mit den Merkmalen des Patentanspruchs 1 gelöst. Ein die Aufgabe lösendes, zur Durchführung des Verfahrens geeignetes Kommunikationssystem wird durch den ersten Sachanspruch charakterisiert. Vorteilhafte Aus- und Weiterbildungen der Erfindung sind durch die jeweiligen Unteransprüche gegeben.The task is solved by a method with the features of patent claim 1 . A communication system that solves the task and is suitable for carrying out the method is characterized by the first claim. Advantageous training and developments of the invention are given by the respective dependent claims.

Das eingangs angesprochene Sicherheitskonzept betrifft den Betrieb eines aus zwei Endpunkten und aus einer Datenverbindung zwischen diesen Endpunkt bestehenden Kommunikationssystems. Vorzugsweise (aber nicht zwingend und insoweit auch nicht beschränkend) bezieht sich die Erfindung hierbei auf ein Verfahren, welches für ein Kommunikationssystem verwendet wird, in welchem es sich bei den durch die Datenverbindung miteinander verbundenen Endpunkten um zwei Netzwerkknoten in einem Netzwerk handelt. Bei den angesprochenen Endpunkten des Kommunikationssystems kann es sich aber zum Beispiel auch um miteinander verbundene Komponenten innerhalb eines Netzwerkknotens handeln. Das zur Lösung vorgeschlagene Verfahren geht davon aus, dass zwischen dem ersten Endpunkt und dem zweiten Endpunkt des vorgenannten Kommunikationssystems ausgetauschte Nutzdaten symmetrisch verschlüsselt werden. Die symmetrische Verschlüsselung der Nutzdaten erfolgt hierbei mittels eines in den beiden Endpunkten vorhandenen Schlüssels, der auf einer in dem ersten Endpunkt erzeugten, nach dem Public-Key-Verfahren als Shared Secret an den zweiten Endpunkt übertragenen Zufallszahl basiert.The security concept mentioned at the beginning relates to the operation of a communication system consisting of two end points and a data connection between these end points. The invention preferably (but not necessarily and in this respect also not restrictively) relates to a method which is used for a communication system in which the end points connected to one another by the data connection are two network nodes in a network. However, the addressed end points of the communication system can also be components within a network node that are connected to one another, for example. The method proposed for the solution assumes that user data exchanged between the first endpoint and the second endpoint of the aforementioned communication system are encrypted symmetrically. The symmetrical encryption of the user data is carried out using a key present in the two endpoints, which is based on a random number generated in the first endpoint and transmitted to the second endpoint as a shared secret according to the public-key method.

Erfindungsgemäß ist es dabei vorgesehen, dass in einem Basisbetrieb des Kommunikationssystems unmittelbar die vorgenannte Zufallszahl, also das zwischen den Endpunkten nach dem Public-Key-Verfahren ausgetauschte Shared Secret selbst, zur symmetrischen Verschlüsselung der zwischen den Endpunkten übertragenen Nutzdaten verwendet wird. Bei einem Komfortbetrieb des Kommunikationssystems, nämlich in einem Betrieb mit in Bezug auf die Verschlüsselung der Nutzdaten erhöhter Sicherheit, erfolgt hingegen die symmetrische Verschlüsselung der Nutzdaten mittels eines Schlüssels, der gebildet wird durch eine bitweise XOR-Verknüpfung des Basisschlüssels mit einem in beiden Endpunkten vorliegenden Zusatzschlüssel, bei welchem es sich um einen Quantenschlüssel, das heißt um einen nach einem quantensicheren Verfahren erzeugten Schlüssel, handelt.According to the invention, it is provided that in basic operation of the communication system the aforementioned random number, i.e. the shared secret itself exchanged between the endpoints according to the public key method, is used for symmetric encryption of the user data transmitted between the endpoints. In contrast, when the communication system is operated in a comfort mode, namely when it is operated with increased security in relation to the encryption of the user data, the user data is symmetrically encrypted using a key that is formed by a bit-by-bit XOR combination of the basic key with an additional key present in both end points , which is a quantum key, i.e. a key generated using a quantum-secure method.

Das Verfahren ist hierbei weiterhin so gestaltet, dass das Kommunikationssystem im Falle seiner Nutzung in dem zuvor genannten Komfortbetrieb und einer dabei auftretenden Störung automatisiert in den Basisbetrieb zurückfällt, bei welchem die Verschlüsselung der Nutzdaten unmittelbar mittels der nach dem Public-Key-Verfahren ausgetauschten, als Basisschlüssel dienenden Zufallszahl erfolgt. Im Hinblick auf die beiden vorgenannten Betriebsmodi liegt des Kommunikationssystems liegt diesem demnach ein mindestens zweistufiges Sicherheitskonzept zugrunde, wobei weitere, insbesondere gemäß entsprechender Ausgestaltungen und Weiterbildungen des Verfahrens vorgesehene Aspekte, je nach Standpunkt, auch als weitere Sicherheitsstufe dieses Konzeptes angesehen werden können.The method is also designed in such a way that the communication system automatically reverts to basic operation if it is used in the aforementioned comfort mode and a fault occurs, in which the user data is encrypted directly using the public-key method exchanged as Base key serving random number takes place. With regard to the two aforementioned operating modes, the communication system is based on an at least two-stage security concept, with other aspects provided in particular according to corresponding refinements and developments of the method, depending on the point of view, also being regarded as a further security level of this concept.

Der Begriff "Komfortbetrieb" für die Betriebsart, bei welcher die Verschlüsselung der Nutzdaten mittels eines durch bitweise XOR-Verknüpfung des Basisschlüssels mit einem Zusatzschlüssel erzeugten Schlüssels erfolgt, ist dabei im Grunde willkürlich und dient in den weiteren Darstellungen lediglich der sprachlichen Vereinfachung. Diese Bezeichnung ist insofern willkürlich, als es sich je nach Konfiguration und Anordnung des angesprochenen Kommunikationssystems in einem Gesamtsystem (Netzwerk) bei dieser Betriebsart auch um einen Regelbetrieb des Kommunikationssystems handeln kann. Letzteres kann beispielsweise insbesondere der Fall sein, wenn das betrachtete Kommunikationssystem Teil des Kernnetzes eines von einem Provider unterhaltenen Weitverkehrsnetzes ist. Hier wird dann regelmäßig, also im Regelbetrieb, eine Verschlüsselung mit einem höheren Maß an Sicherheit zum Einsatz gelangen, bei welcher die Nutzdaten nicht lediglich mittels des im Public-Key-Verfahren zwischen den Endpunkten des Kommunikationssystems ausgetauschten (und hierbei möglicherweise durch einen Angreifer abgefangenen) Shared Secret, sondern mit einem im Wege einer XOR-Verknüpfung dieser Zufallszahl mit einem Zusatzschlüssel erzeugten Schlüssel erfolgt. Das System geht hierbei zum Beispiel im Falle einer Störung in den vermeintlich (aber nicht unbedingt tatsächlich) weniger sicheren Basisbetrieb.The term "comfort mode" for the operating mode in which the user data is encrypted using a key generated by bitwise XORing the basic key with an additional key is basically arbitrary and is used in the further representations only for linguistic purposes Simplification. This designation is arbitrary insofar as, depending on the configuration and arrangement of the communication system in question in an overall system (network), this operating mode can also be a regular operation of the communication system. The latter can be the case, for example, in particular if the communication system under consideration is part of the core network of a wide area network maintained by a provider. Encryption with a higher level of security will then be used regularly, i.e. in regular operation, in which the payload data is not only exchanged between the end points of the communication system using the public key method (and possibly intercepted by an attacker) shared secret, but with a key generated by means of an XOR operation of this random number with an additional key. In the event of a fault, for example, the system goes into what is supposedly (but not necessarily actually) less secure basic operation.

Andererseits kann es aber auch vorgesehen sein, dass ein Kommunikationssystem gewissermaßen standardmäßig in dem angesprochenen Basisbetrieb arbeitet, bei welchem die Verschlüsselung der Nutzdaten unmittelbar mittels des im Public-Key-Verfahren ausgetauschten Schlüssels (der ausgetauschten Zufallszahl) erfolgt. Hierbei kann es dann weiterhin vorgesehen sein, dass dem sehr sicherheitsbewussten Anwender oder einem Anwender mit grundsätzlich höheren Sicherheitsanforderungen die Möglichkeit eingeräumt wird, im Sinne einer kostenpflichtigen, zusätzlich buchbaren Option das Kommunikationssystem in der sichereren, vor diesem Hintergrund als "Komfortbetrieb" bezeichneten Betriebsart mit Verwendung eines durch XOR-Verknüpfung von Basisschlüssel und Zusatzschlüssel entstandenen Schlüssels zu nutzen. Zur Frage dessen, wie Letzteres, also die Frage des Hinzubuchens des Komfortbetriebs, realisiert sein kann, sollen später noch einige Ausführungen erfolgen.On the other hand, however, it can also be provided that a communication system works as it were by default in the addressed basic operation, in which the user data is encrypted directly using the key (the exchanged random number) exchanged using the public key method. Provision can then also be made for the very security-conscious user or a user with fundamentally higher security requirements to be given the option of using the communication system in the more secure operating mode referred to as "comfort mode" in the context of a chargeable, additionally bookable option to use a key created by XOR linking a basic key and an additional key. A few comments will be made later on how the latter, i.e. the question of adding comfort mode, can be implemented.

Ergänzend sei an dieser Stelle darauf hingewiesen, dass im Zusammenhang mit der Erläuterung des erfindungsgemäßen Grundprinzips sowie mit der in Patentansprüchen charakterisierten Lösung lediglich exemplarisch (ebenfalls zur sprachlichen Vereinfachung) von einem Basisschlüssel gesprochen wird. In der Praxis werden hingegen regelmäßig mehrere Basisschlüssel zwischen den Endpunkten - wie beispielsweise Netzwerkknoten - ausgetauscht werden sowie mehrere Quantenschlüssel von dem gemeinsamen, bei beiden Endpunkten vorliegenden Vorrat an Quantenschlüsseln umfasst sein. Insoweit wird vorzugsweise für jeden Übertragungsvorgang ein jeweils anderer Basisschlüssel (Basisbetrieb) oder eine jeweils andere durch XOR-Verknüpfung von Basisschlüssel und Zusatzschlüssel gebildete Bitsequenz (Komfortbetrieb) für die Verschlüsselung der übertragenen Nutzdaten zum Einsatz gelangen.In addition, it should be pointed out at this point that in connection with the explanation of the basic principle according to the invention and with the Patent claims characterized solution is spoken only by way of example (also for linguistic simplification) of a basic key. In practice, on the other hand, several base keys are regularly exchanged between the endpoints—such as network nodes, for example—and several quantum keys are included in the common stock of quantum keys present at both endpoints. In this respect, a different basic key (basic mode) or a different bit sequence formed by XORing basic key and additional key (comfort mode) is preferably used for the encryption of the transmitted user data for each transmission process.

Das heißt, jeder Schlüssel beziehungsweise jede als Schlüssel dienende Bitfolge wird vorzugsweise nur einmal Verwendung finden. Ganz besonders bevorzugt ist dabei eine Verwendung des entsprechenden Schlüssels als One Time Pad, wobei der betreffende Schlüssel dieselbe Bitlänge aufweist, wie der Block in einem Übertragungsvorgang zu übertragender Nutzdaten. In jedem Falle ist daher von dem Patentanspruch 1 die Möglichkeit umfasst, dass zwischen den Endpunkten des Kommunikationssystems fortwährend Schlüssel nach dem Public-Key-Prinzip ausgetauscht werden, welche im Basisbetrieb unmittelbar zur Verschlüsselung von Nutzdaten oder im Komfortbetrieb zur Bildung der zur Verschlüsselung der Nutzdaten dienenden Bitfolge verwendet werden.This means that each key or each bit sequence serving as a key is preferably only used once. The use of the corresponding key as a one-time pad is particularly preferred, with the relevant key having the same bit length as the block of user data to be transmitted in a transmission process. In any case, therefore, patent claim 1 includes the possibility of continuously exchanging keys according to the public key principle between the end points of the communication system, which in basic operation are used directly to encrypt user data or in comfort operation to form the keys used to encrypt user data Bit sequence are used.

An dieser Stelle sei nochmals betont, dass es sich bei den vorstehend angesprochenen Endpunkten um unterschiedlichste telekommunikative Einrichtungen, Systeme oder Teile davon handeln kann, zwischen denen Nutzdaten ausgetauscht werden, so beispielsweise auch um Netzwerkknoten eines Netzwerks oder aber auch um Einrichtungen innerhalb solcher Netzwerkknoten.At this point it should be emphasized again that the endpoints mentioned above can be a wide variety of telecommunications devices, systems or parts thereof between which user data is exchanged, for example also network nodes of a network or devices within such network nodes.

Im Hinblick auf eine tatsächlich deutlich erhöhte Sicherheit der Verschlüsselung der Nutzdaten im Komfortbetrieb ist das Verfahren entsprechend einer bevorzugten Ausbildungsform so gestaltet, dass es sich bei dem für die bitweise XOR-Verknüpfung mit dem Basisschlüssel verwendeten Zusatzschlüssel um einen von mehreren, in beiden Endpunkten vorliegenden Quantenschlüsseln handelt. Hierbei wird zwischen den Endpunkten zusätzlich ein Identifier ausgetauscht, welcher den zur XOR-Verknüpfung mit dem Basisschlüssel jeweils zu verwendenden, wie gesagt, in beiden Endpunkten vorliegenden Zusatzschlüssel (Quantenschlüssel) eindeutig bezeichnet. Die Übertragung dieses Identifiers kann beispielsweise zusammen mit dem unter Anwendung des Public-Key-Verfahrens übertragenen Shared Secret, also zusammen mit dem Austausch des Basisschlüssels, erfolgen oder auch in einem gesonderten Übertragungsvorgang.With regard to an actually significantly increased security of the encryption of the user data in comfort mode, the method is designed according to a preferred embodiment in such a way that the additional key used for the bitwise XOR link with the basic key is one of several quantum keys present in both endpoints. In this case, an identifier is also exchanged between the end points, which uniquely designates the additional key (quantum key) to be used for the XOR link with the basic key, as mentioned, present in both end points. This identifier can be transmitted, for example, together with the shared secret transmitted using the public key method, i.e. together with the exchange of the basic key, or also in a separate transmission process.

Durch die Verwendung eines Quantenschlüssels als Zusatzschlüssel wird im Komfortbetrieb ein sehr hohes Maß an Sicherheit bei der Verschlüsselung der Nutzdaten erreicht, da insoweit von einer Verschlüsselung auszugehen ist, die auch nicht durch den Einsatz von Quantencomputern gebrochen werden kann. Gleichwohl bietet das erfindungsgemäße, im Hinblick auf seine beiden möglichen Betriebsmodi, mindestens zweistufige Sicherheitskonzept mit dem Basisbetrieb die Möglichkeit, auch im Falle einer Störung der die Zusatzschlüssel in Form von Quantenschlüsseln bereitstellenden Systeme oder im Falle dessen, dass einmal nicht genug Zusatzschlüssel zur Verfügung stehen, wenigstens ein Mindestmaß an Sicherheit bei der Verschlüsselung von Nutzdaten, insbesondere in Bezug auf Datenverkehre auf dem Layer 1, dem Layer 2 oder dem Layer 3 des OSI-Schichtenmodels zur Verfügung stellen zu können.By using a quantum key as an additional key, a very high level of security is achieved when encrypting the user data in convenience mode, since it can be assumed that encryption can also not be broken through the use of quantum computers. Nevertheless, the security concept according to the invention, with regard to its two possible operating modes, offers at least two-stage security concept with the basic operation, even in the event of a fault in the systems providing the additional keys in the form of quantum keys or in the event that not enough additional keys are available, to be able to provide at least a minimum level of security when encrypting user data, in particular with regard to data traffic on layer 1, layer 2 or layer 3 of the OSI layer model.

Die Erfindung geht also von der Überlegung aus, für besonders sicherheitssensible Bereiche, wie beispielsweise Kernnetze, oder wunschgemäß, gegen Aufpreis, einen Betriebsmodus (Komfortbetrieb) mit sehr hoher Sicherheit bezüglich der Verschlüsselung der Nutzdaten zu ermöglichen, aber für den Fall, dass dieser Betriebsmodus nicht zur Verfügung steht, zumindest einen Basisbetrieb zu ermöglichen, bei dem auch noch ein hohes Maß an Sicherheit besteht.The invention is therefore based on the consideration of enabling an operating mode (comfort mode) with very high security with regard to the encryption of the user data for particularly security-sensitive areas, such as core networks, or if desired, for an additional charge, but in the event that this operating mode is not is available to enable at least basic operation with a high degree of security.

Die Sicherheit im Basisbetrieb lässt sich noch dadurch erhöhen, dass entsprechend einer vorgesehenen, besonders vorteilhaften sowie für die Umsetzung in der Praxis favorisierten Weiterbildung des erfindungsgemäßen Verfahrens die im Basisbetrieb ausschließlich verwendete, als Shared Secret im Public-Key-Verfahren ausgetauschte Zufallszahl zwischen den Endpunkten unter Anwendung eines PQC-Verschlüsselungsverfahrens (PQC = Post Quantum Cryptography) übertragen wird.The safety in basic operation can be further increased by the fact that, according to a further development of the method according to the invention that is provided, is particularly advantageous and is favored for implementation in practice Basic operation exclusively used random number exchanged as a shared secret in the public key method is transmitted between the end points using a PQC encryption method (PQC = Post Quantum Cryptography).

Während Quantenschlüssel, also mittels quantenmechanischer Verfahren erzeugte Schlüssel beziehungsweise auf Quanteneffekten beruhende Verschlüsselungsverfahren, bewiesenermaßen jedenfalls theoretisch einem Angriff mit Quantencomputern standhalten, gibt es einen entsprechenden Beweis für PQC-Verschlüsselungsverfahren nicht. Allerdings handelt es sich bei letzteren um Verschlüsselungsverfahren, welche auf sehr komplexen Algorithmen beruhen, für die - Stand jetzt - davon ausgegangen wird, dass auch sie einem Angriff mit Quantencomputern standhalten. Jedenfalls konnte bisher ein Gegenbeweis nicht erbracht werden.While quantum keys, i.e. keys generated using quantum mechanical methods or encryption methods based on quantum effects, have been proven to withstand an attack with quantum computers, at least theoretically, there is no corresponding proof for PQC encryption methods. However, the latter are encryption methods that are based on very complex algorithms for which - as of now - it is assumed that they, too, can withstand an attack with quantum computers. In any case, no proof to the contrary has been provided so far.

Das heißt aber auch, dass bei einer Gestaltung des Verfahrens, bei welcher für den Austausch des als Basisschlüssel dienenden Shared Secret ein PQC-Verschlüsselungsverfahren zum Einsatz gelangt, der Basisbetrieb im Grunde das gleiche Maß an Sicherheit bietet wie ein unter Verwendung von quantenmechanisch erzeugten Schlüsseln ausgeführter Komfortbetrieb. Insoweit ist durch den Einsatz der Erfindung gewissermaßen doppelte Sicherheit gegeben, in deren Rahmen der Basisbetrieb im Grunde eine Art Sicherheitsredundanz darstellt. Gleichzeitig kann zum Beispiel eine Quantenschlüssel-Sicherheit auf der Anwenderebene unabhängig von der Providerebene (providerspezifischen Ebene) bereitgestellt werden, wobei der Anwender auch seinen eigenen Schlüssel einbringen könnte, der vom Provider nicht einsehbar wäre.However, this also means that if the method is designed in which a PQC encryption method is used to exchange the shared secret that serves as the basic key, the basic operation basically offers the same level of security as one performed using keys generated by quantum mechanics comfort mode. In this respect, the use of the invention provides double security, so to speak, within the framework of which the basic operation basically represents a kind of security redundancy. At the same time, for example, quantum key security can be provided at the user level independently of the provider level (provider-specific level), where the user could also bring in their own key that would not be visible to the provider.

Im Falle des Einsatzes eines PQC-Verschlüsselungsverfahrens für die nach dem Public-Key-Verfahren erfolgende Übertragung des Basisschlüssels (Shared Secret) zwischen den Endpunkten ist das Verfahren vorzugsweise zudem so gestaltet, dass sich die Endpunkte vor dem Austausch des Shared Secret gegenseitig unter Anwendung eines PQC-Signaturverfahrens authentifizieren. Die Endpunkte können hierzu vor dem Austausch des Shared Secret beispielsweise eine beiderseits bekannte Nachricht austauschen, welche sie mittels ihrer eindeutigen, nach einem PQC-Signaturverfahren erzeugten Signatur versehen. In diesem Zusammenhang ist allerdings anzumerken, dass PQC-Verschlüsselungsverfahren in der Praxis regelmäßig in Kombination mit entsprechenden, der Authentifizierung dienenden PQC-Signaturverfahren zum Einsatz gelangen, so dass beide Ausgestaltungsformen - Austausch des Basisschlüssel durch PQC-Verschlüsselung und Authentifizierung durch PQ-Signierverfahren eigentlich zusammengehören.In the case of the use of a PQC encryption method for the public key method transmission of the base key (shared secret) between the endpoints, the method is preferably also designed so that the endpoints mutually prior to the exchange of the shared secret using a Authenticate PQC signature process. The Endpoints For example, before exchanging the shared secret, they can exchange a mutually known message, which they provide using their unique signature generated using a PQC signature process. In this context, however, it should be noted that in practice PQC encryption methods are regularly used in combination with corresponding PQC signature methods used for authentication, so that both forms of implementation - replacement of the basic key by PQC encryption and authentication by PQ signing methods - actually belong together .

Ein jeweiliger Zusatzschlüssel, also der zur bitweisen XOR-Verknüpfung mit dem Basisschlüssel verwendete Quantenschlüssel, kann entsprechend einer möglichen Ausgestaltungsform der Erfindung durch die beiden dafür entsprechend ausgebildeten Endpunkte (zum Beispiel Netzwerkknoten) gemeinsam durch Anwendung eines QKD-Verfahrens erzeugt werden. Es ist aber auch möglich, dass ein solcher Quantenschlüssel durch eine externe Quelle erzeugt und beiden Endpunkten zur Verfügung gestellt wird. Bei einer solchen Vorgehensweise kann das Bereitstellen des Komfortbetriebs als kostenpflichtige Zusatzoption beispielsweise durch Nachrüstung von QKD-Systemen in den beiden Endpunkten erfolgen. Grundsätzlich denkbar ist es aber auch, dass die Endpunkte bereits über entsprechende QKD-Systeme verfügen, welche nur im Falle einer Nutzung des Komfortbetriebs aktiv eingebunden werden.According to one possible embodiment of the invention, a respective additional key, i.e. the quantum key used for the bitwise XOR operation with the basic key, can be generated jointly by the two appropriately designed end points (e.g. network nodes) by using a QKD method. However, it is also possible for such a quantum key to be generated by an external source and made available to both endpoints. With such a procedure, the comfort mode can be provided as an additional option that is subject to a charge, for example by retrofitting QKD systems in the two end points. In principle, however, it is also conceivable that the end points already have corresponding QKD systems, which are only actively integrated if comfort mode is used.

Darüber hinaus ist aber auch eine Verfahrensgestaltung möglich, bei welcher die beiden Endpunkte des Kommunikationssystems untereinander nicht in einer QKD-Beziehung stehen, aber jeweils über mindestens zwei vollständig disjunkte Verbindungspfade mit zwei anderen, einen QKD-Verbund ausbildenden Endpunkten verbunden sind. In diesem Falle werden den untereinander nicht in einer QKD-Beziehung stehenden Endpunkte des Kommunikationssystems, die als Zusatzschlüssel zur Ausführung des erfindungsgemäßen Komfortbetriebs verwendbaren Quantenschlüssel nach einem speziellen Verfahren gewissermaßen als QKD as a Service (QaaS) zur Verfügung gestellt. Ein dafür geeignetes, sich insbesondere auf Netzwerkknoten in einem Netzwerk beziehendes Verfahren wird beispielsweise in der DE 10 2019 118 286 der Anmelderin beschrieben.In addition, however, a method design is also possible in which the two endpoints of the communication system are not in a QKD relationship with one another, but are each connected to two other endpoints forming a QKD network via at least two completely disjoint connection paths. In this case, the end points of the communication system that are not in a QKD relationship with each other are provided with the quantum keys that can be used as additional keys for carrying out the comfort operation according to a special method, so to speak, as QKD as a Service (QaaS). A suitable, itself Method relating in particular to network nodes in a network is described, for example, in DE 10 2019 118 286 described by the applicant.

Hierbei wird der als Zusatzschlüssel dienende Quantenschlüssel den beiden Endpunkten des Kommunikationssystems durch den QKD-Verbund mittels eines Übertragungsverfahrens zur Verfügung gestellt, bei dem durch den QKD-Verbund mehrere, durch bitweise XOR-Verknüpfung vom QKD-Verbund erzeugter Quantenschlüssel gebildete Bitsequenzen an beide Endpunkte des Kommunikationssystems über je einen der disjunkten Verbindungspfade übertragen werden. Mindestens eine der vorgenannten, durch bitweise XOR-Verknüpfung von Quantenschlüsseln erzeugte Bitsequenz wird dabei unter Einbeziehung des an die Endpunkte des hier im Rahmen der Erfindung betrachteten Kommunikationssystems auszuliefernden Zusatzschlüssels gebildet. Die beiden Endpunkte können diesen Zusatzschlüssel aus dem über die beiden disjunkten Verbindungspfade bei ihnen eingehenden Bitsequenzen extrahieren, indem sie alle bei ihnen zur Übertragung dieses Zusatzschlüssels eingehenden Bitsequenzen miteinander XOR-verknüpfen.The quantum key serving as an additional key is made available to the two end points of the communication system by the QKD network by means of a transmission method in which the QKD network sends several quantum keys formed by bitwise XOR linking generated by the QKD network to both end points of the Communication system are transmitted via one of the disjoint connection paths. At least one of the aforementioned bit sequences generated by bitwise XORing of quantum keys is formed including the additional key to be delivered to the end points of the communication system considered here within the scope of the invention. The two endpoints can extract this additional key from the bit sequences they receive via the two disjoint connection paths by XORing together all the bit sequences they receive for the transmission of this additional key.

Dieses Verfahren ermöglicht es in besonders vorteilhafter Weise, beiden Endpunkte des hier betrachteten Kommunikationssystems für die bitweise XOR-Verknüpfung mit dem Basisschlüssel als Zusatzschlüssel zu verwendende Quantenschlüssel zur Verfügung zu stellen, ohne dass die Endpunkte selbst in einer QKD-Beziehung untereinander stehen oder über sonstige Mittel zur Erzeugung von Quantenschlüsseln verfügen müssten. Insoweit eignet sich diese Variante besonders gut dazu, dem Kommunikationssystem den Komfortbetrieb gegebenenfalls als kostenpflichtige Zusatzoption zur Verfügung zu stellen. Sofern diese Zusatzoption genutzt wird ist dabei - vorausgesetzt, dass die Endpunkten des Kommunikationssystems jeweils über zwei disjunkte Wege mit ein und demselben QKD-Verbund verbunden sind - lediglich ein entsprechender Modus zu aktivieren, bei dem die QKD-Knoten des besagten QKD-Verbunds, welche gegebenenfalls auch Quantenschlüssel für andere Endpunkte anderer Systeme - oder, sofern es sich bei den Endpunkten um Netzwerkknoten eines Netzwerks handelt, für andere Netzwerkknoten des Netzwerks - bereitstellen, einen Teil der von ihnen erzeugten Quantenschlüssel an die Endpunkte des erfindungsgemäßen Kommunikationssystems übertragen.This method makes it possible in a particularly advantageous manner to provide both endpoints of the communication system considered here for the bitwise XOR operation with the base key as an additional key to be used as an additional key, without the endpoints themselves being in a QKD relationship with one another or by other means to generate quantum keys. In this respect, this variant is particularly well suited to making the comfort mode available to the communication system, if necessary as an additional option that is subject to a charge. If this additional option is used - provided that the end points of the communication system are each connected to one and the same QKD network via two disjoint paths - only a corresponding mode has to be activated in which the QKD nodes of said QKD network, which possibly also quantum keys for other endpoints of other systems - or, if the endpoints are network nodes of a network, for other network nodes of the network - provide, transmit part of the quantum key generated by them to the end points of the communication system according to the invention.

Das beschriebene Verfahren kann in Systemen auf verschiedenen Layern des OSI-Schichtenmodells, zum Beispiel auf Layer 1 (physikalische Ebene), Layer 2 (Data Link Ebene) oder Layer 3 (IP Network Ebene) eingesetzt werden, um die entsprechenden Systeme quantensicher zu schützen.The method described can be used in systems on different layers of the OSI layer model, for example on layer 1 (physical layer), layer 2 (data link layer) or layer 3 (IP network layer) in order to provide quantum-safe protection for the corresponding systems.

Layer-1-Verschlüsseler verschlüsseln beispielsweis Lichtsignale die in Glasfasermedien in OTN-Systemen (OTN = Optical Transport Network) oder elektrische Signale die auf Kupfermedien in Kupferkabel Systemen transportiert werden. Die Verschlüsselung erfolgt in diesem Fall unabhängig von Protokollen oder Applikationen. Über die Layer-1-Verschlüsselung entsteht kein Protokolloverhead, so dass die volle Bandbreite der Medien genutzt werden kann.Layer 1 encryptors, for example, encrypt light signals that are transported in fiber optic media in OTN systems (OTN = Optical Transport Network) or electrical signals that are transported on copper media in copper cable systems. In this case, the encryption is independent of protocols or applications. There is no protocol overhead with Layer 1 encryption, so the full bandwidth of the media can be used.

Layer-2-Verschlüsseler erlauben eine gesicherte Übertragung von zum Beispiel Unicast-, Multicast- oder Broadcast-Daten, beispielsweise in Ethernet Systemen. Die Layer-2-Verschlüsselung ist komplett von sämtlichen Applikationen auf höheren Ebenen entkoppelt und liefert, durch einen geringen Overhead, deutliche Geschwindigkeitsvorteile gegenüber einer Layer-3-Verschlüsselung.Layer 2 encryptors allow secure transmission of, for example, unicast, multicast or broadcast data, for example in Ethernet systems. Layer 2 encryption is completely decoupled from all applications at higher levels and, thanks to the low overhead, provides significant speed advantages over Layer 3 encryption.

Layer-3-IP-Verschlüsseler erlauben eine Übertragung von Daten, die zum Beispiel über eine Virtuelle Private Netzwerk (VPN) Verbindung gesichert werden. Dies erlaubt gesicherte Netze, die gemeinsame IP-Adressräume gestatten und somit unterschiedliche Anwendungen ermöglichen, quantensicher zu schützen. Die Layer-3- Verschlüsselung erzeugt den größten Overhead und ist daher mit Geschwindigkeitseinbußen verbunden.Layer 3 IP encryptors allow data to be transmitted that is secured, for example, via a virtual private network (VPN) connection. This allows secure networks that allow common IP address spaces and thus enable different applications to be protected in a quantum-safe manner. Layer 3 encryption generates the greatest overhead and is therefore associated with a loss of speed.

Ein die Aufgabe lösendes, zur Durchführung des erfindungsgemäßen Verfahrens geeignetes Kommunikationssystem besteht zunächst aus zwei Endpunkten und aus einer die beiden Endpunkte untereinander verbindenden Datenverbindung. Darüber hinaus ist das Kommunikationssystem wie folgt beschaffen:

  1. a) Beide Endpunkte des Kommunikationssystems sind dazu ausgebildet, über die Datenverbindung ausgetauschte Nutzdaten verschlüsselt zu übertragen. Dafür verfügt jeder der beiden Endpunkte über einen Verschlüsseler, das heißt über eine Ver- und Entschlüsselungseinrichtung.
  2. b) Beide Endpunkte des Kommunikationssystems verfügen über einen gemeinsamen Vorrat an Quantenschlüsseln. Die Schlüssel dieses Vorrats werden in jedem der beiden Endpunkte durch einen lokalen Schlüsselspeicher gehalten und mittels je eines lokalen Schlüsselmanagements (synonym auch Key Management) der Endpunkte verwaltet.
  3. c) Mindestens ein erster der beiden Endpunkte ist zur Erzeugung von als Basisschlüssel zu verwendenden Zufallszahlen ausgebildet. Dieser erste Endpunkt verfügt zur Übertragung von ihm erzeugter Basisschlüssel an den anderen, das heißt an den zweiten Endpunkt des Kommunikationssystems, über einen öffentlichen Schlüssel dieses zweiten Endpunktes, mit dessen Hilfe er die Basisschlüssel unter Nutzung eines Public-Key-Verfahrens an den zweiten Endpunkt überträgt. Der zweite Endpunkt verfügt seinerseits über einen mit dem von dem ersten Endpunkt verwendeten öffentlichen Schlüssel korrespondierenden geheimen Schlüssel zur Entschlüsselung der an ihn übertragenen den Basisschlüssel enthaltenden Bitsequenz (Zufallszahl).
A communication system that solves the problem and is suitable for carrying out the method according to the invention initially consists of two end points and from a data connection connecting the two endpoints with each other. In addition, the communication system is designed as follows:
  1. a) Both end points of the communication system are designed to transmit user data exchanged via the data connection in encrypted form. For this, each of the two endpoints has an encryptor, i.e. an encryption and decryption device.
  2. b) Both endpoints of the communication system have a shared set of quantum keys. The keys of this pool are kept in each of the two endpoints by a local key memory and are managed by means of a local key management (synonymously also key management) of the endpoints.
  3. c) At least a first of the two end points is designed to generate random numbers to be used as a base key. This first endpoint has a public key for this second endpoint to transmit the base key it has generated to the other endpoint, i.e. to the second endpoint of the communication system, with the help of which it transmits the base key to the second endpoint using a public-key method . The second endpoint, for its part, has a secret key corresponding to the public key used by the first endpoint, for decrypting the bit sequence (random number) containing the base key transmitted to it.

Erfindungsgemäß ist das Kommunikationssystem in einem Basisbetrieb und in einem Komfortbetrieb, nämlich in einem Betrieb mit in Bezug auf die Verschlüsselung der zwischen den beiden Endpunkten ausgetauschten Nutzdaten erhöhter Sicherheit, betreibbar. In dem Basisbetrieb des Kommunikationssystems verschlüsseln dessen Endpunkte die zwischen ihnen ausgetauschten Nutzdaten jeweils mit einer durch den ersten Endpunkt erzeugten, als Basisschlüssel dienenden Zufallszahl symmetrisch. Die jeweilige Zufallszahl, also der jeweilige Basisschlüssel, wird als Shared Secret von dem ersten, sie erzeugenden Endpunkt unter Verwendung eines von den Endpunkten ausführbaren PQC-Verschlüsselungsverfahrens, verschlüsselt mit dem öffentlichen Schlüssel des zweiten Endpunkts, an den zweiten Endpunkt übertragen, welcher seinerseits diese Zufallszahl aus der von ihm empfangenen Sequenz mittels seines privaten Schlüssels extrahiert.According to the invention, the communication system can be operated in a basic mode and in a comfort mode, namely in an mode with increased security in relation to the encryption of the user data exchanged between the two endpoints. In the basic operation of the communication system, its endpoints encrypt the user data exchanged between them with a base key generated by the first endpoint serving random number symmetrically. The respective random number, i.e. the respective basic key, is transmitted as a shared secret from the first endpoint that generates it using a PQC encryption method that can be executed by the endpoints, encrypted with the public key of the second endpoint, to the second endpoint, which in turn transmits this random number extracted from the sequence he received using his private key.

In dem Komfortbetrieb verschlüsseln die Endpunkte des Kommunikationssystems die zwischen ihnen ausgetauschten Nutzdaten mittels eines Schlüssels, welchen sie durch bitweise XOR-Verknüpfung des zwischen ihnen ausgetauschten Basisschlüssels mit einem identisch in beiden Endpunkten dazu verwendeten, aus ihrem gemeinsamen Vorrat entnommenen Quantenschlüssel (Zusatzschlüssel) erzeugen.In convenience mode, the endpoints of the communication system encrypt the user data exchanged between them using a key, which they generate by bitwise XORing the basic key exchanged between them with a quantum key (additional key) taken from their common stock and used identically in both endpoints.

Bei dem erfindungsgemäßen Kommunikationssystem sind zur Realisierung der beiden zuvor beschriebenen Betriebsmodi die Verschlüsseler beider Endpunkte jeweils mit einem PQC-Server zur Ausführung des bereits erwähnten PQC-Verschlüsselungsverfahrens sowie mit einer Einheit zur bitweisen XOR-Verknüpfung von Bitsequenzen bei der Ausführung des Komfortbetriebs ausgestattet.In the communication system according to the invention, to implement the two operating modes described above, the encryptors of both endpoints are each equipped with a PQC server for executing the aforementioned PQC encryption method and with a unit for bitwise XORing of bit sequences when executing comfort mode.

Wie bereits eingangs und zum Verfahren ausgeführt, handelt es sich bei einer möglichen Ausbildungsform des erfindungsgemäßen Kommunikationssystems und im Hinblick auf einen bevorzugten Anwendungsfall der Erfindung um ein Kommunikationssystem, dessen Endpunkte durch zwei Netzwerkknoten ausgebildet sind, wobei dieses Kommunikationssystem gegebenenfalls auch Teil eines umfassenderen, eine Vielzahl von Netzwerkknoten aufweisenden Netzwerks sein kann. Bei den Netzwerkknoten des Kommunikationssystems kann es sich in diesem Anwendungskontext sowohl um zwei Netzwerkknoten eines lokalen Netzes als auch um zwei in jeweils unterschiedlichen lokalen Netzen, wie beispielsweise in zwei Metro-Netzen, oder gar in zwei kontinentalen, über eine interkontinentale Datenverbindung miteinander verbunden Netzen - gewissermaßen als Übergangsknoten - angeordnete Netzwerkknoten handeln.As already explained at the beginning and with regard to the method, one possible embodiment of the communication system according to the invention and, with regard to a preferred application of the invention, is a communication system whose end points are formed by two network nodes, this communication system possibly also being part of a more comprehensive, multiplicity network having network nodes can be. In this application context, the network nodes of the communication system can be either two network nodes in a local network or two in different local networks, such as in two metro networks, or even in two continental networks, via one intercontinental data connection networks connected to each other - act arranged network nodes - to a certain extent as transition nodes.

Eine bevorzugte Weiterbildung des zuvor beschriebenen Kommunikationssystems ist dadurch gegeben, dass beide Endpunkte des Kommunikationssystems über ein QKD-System verfügen. Hierbei stehen die Endpunkte unter Nutzung dieses QKD-Systems untereinander in einer QKD-Beziehung zur Erzeugung der als Zusatzschlüssel dienenden Quantenschlüssel, wobei deren Erzeugung nach einem QKD-Verfahren, das heißt nach einem Verfahren der Quantum Key Distribution, erfolgt. Die Endpunkte des Kommunikationssystems können demnach bei dieser Ausbildungsform vorteilhafterweise die zur bitweisen XOR-Verknüpfung mit einem jeweiligen Basisschlüssel dienenden quantensicheren Zusatzschlüssel (Quantenschlüssel) selbst erzeugen.A preferred development of the communication system described above is given by the fact that both end points of the communication system have a QKD system. Using this QKD system, the endpoints are in a QKD relationship with one another to generate the quantum key serving as an additional key, the generation of which takes place according to a QKD method, ie according to a method of quantum key distribution. In this embodiment, the end points of the communication system can advantageously generate the quantum-secure additional keys (quantum keys) used for the bit-by-bit XOR operation with a respective base key.

Das erfindungsgemäße Kommunikationssystem kann außerdem vorteilhaft dadurch weitergebildet sein, dass dessen erster Endpunkt zur Erzeugung der als Basisschlüssel zu verwendenden Zufallszahlen über einen Quantum Random Number Generator QRNG verfügt.The communication system according to the invention can also be advantageously further developed in that its first endpoint has a quantum random number generator QRNG for generating the random numbers to be used as the base key.

Für die vorgestellte Erfindung lassen sich folgende Vorteile angeben:
Der wesentlichste Vorteil der Erfindung liegt in der Eliminierung einer Schwachstelle (mögliche Nutzung von Basisschlüssel ohne Quantensicherheit) in der Implementierung von Verschlüsselungsprotokollen bei marktüblichen Verschlüsselern. Die vorgestellte Lösung ist insbesondere anwendbar auf alle Verschlüsseler, die auf den OSI Layer 1, Layer 2 oder Layer 3 operieren.The following advantages can be stated for the presented invention:
The most important advantage of the invention lies in the elimination of a vulnerability (possible use of basic keys without quantum security) in the implementation of encryption protocols with commercially available encryptors. The solution presented is particularly applicable to all encryptors that operate on OSI Layer 1, Layer 2 or Layer 3.

Insbesondere durch die Implementierung einer bevorzugten Ausbildungsform der erfindungsgemäßen Lösung, mit dem Austausch eines selbst quantensicheren Basisschlüssels unter Verwendung der Post Quantum Kryptographie (PQC), wird die Sicherheit von Layer-1-, Layer-2- oder Layer-3-Übertragungssystemen deutlich erhöht. Zusammen liefern die QKD- und PQC-Systeme eine erhöhte Sicherheit, wobei auch beim vorübergehenden Ausfall eines der beiden Systeme eine quantensichere Kommunikation für das Gesamtsystem gewährleistet wird. Die vorgestellte Lösung kann dabei in QKD-Architekturen transparent und minimal invasiv integriert werden.The security of layer 1, layer 2 or layer 3 transmission systems is significantly increased in particular by the implementation of a preferred embodiment of the solution according to the invention, with the exchange of a self-quantum-secure base key using post-quantum cryptography (PQC). Together, the QKD and PQC systems provide increased Security, whereby even in the event of a temporary failure of one of the two systems, quantum-secure communication is guaranteed for the entire system. The solution presented can be integrated transparently and minimally invasively into QKD architectures.

Zudem sind folgende Sicherheitsbetrachtungen als relevant anzusehen:
Die Sicherheit der vorgestellten Erfindung hängt direkt von der Sicherheit der verwendeten kryptografischen Verfahren ab. Die theoretische Sicherheit des Quantenschlüsselaustausches ist bewiesen und hängt maßgeblich von der Gültigkeit der Gesetze der Quantenmechanik ab, während die praktische Sicherheit abhängig von der technischen Implementierung eines jeweiligen QKD-Systems und den Möglichkeiten technischer Side Channels ist.In addition, the following safety considerations are to be regarded as relevant:
The security of the invention presented depends directly on the security of the cryptographic methods used. The theoretical security of the quantum key exchange has been proven and depends largely on the validity of the laws of quantum mechanics, while the practical security depends on the technical implementation of a respective QKD system and the possibilities of technical side channels.

Die PQC-Kryptosysteme werden zurzeit entwickelt, überprüft und unterliegen aufwändigen Standardisierungsbemühungen. Obwohl es keinen Beweis ihrer absoluten Sicherheit gibt, gelten die Algorithmen aufgrund geltender Annahmen und Kenntnisse über Algorithmen eines Quantencomputers als sicher.The PQC cryptosystems are currently being developed, checked and are subject to extensive standardization efforts. Although there is no proof of their absolute safety, the algorithms are considered safe based on current assumptions and knowledge about the algorithms of a quantum computer.

Die Anwendung von "Post Quantum" Verschlüsselung (PQC) und Authentifizierung zusätzlich zu quantensicheren Schlüsseln, die über Verfahren des Quantenschlüssel-Austausches (QKD) erzeugt werden, liefert zusammen ein Verfahren mit erhöhter Sicherheit. Sollte ein Verfahren ausfallen, fehlerhaft sein oder angegriffen werden, so schützt das zweite Verfahren weiterhin die Vertraulichkeit der quantensicheren Kommunikation.The application of post-quantum encryption (PQC) and authentication in addition to quantum-secure keys generated via quantum key exchange (QKD) methods together provide a method with increased security. If one method fails, is faulty or is attacked, the second method continues to protect the confidentiality of the quantum-secure communication.

Die beiden Verfahren, "Post Quantum" Kryptographie (PQC) und Quantenschlüsselaustausch (QKD) können als komplementäre technische Ansätze implementiert werden. Während QKD auf einem hardwarezentrierten Ansatz unter Ausnutzung von quantenmechanischen Effekten beruht, nutzt die PQC einen softwarezentrierten Ansatz zur Implementierung härterer mathematischer Probleme als Basis neuer kryptographischer Protokolle.The two methods, "Post Quantum" Cryptography (PQC) and Quantum Key Exchange (QKD) can be implemented as complementary technical approaches. While QKD is based on a hardware-centric approach using quantum mechanical effects, PQC uses a software-centric approach to implement harder mathematical problems as the basis of new cryptographic protocols.

Nachfolgend soll anhand der Fig. 1 ein Ausführungsbeispiel für die Erfindung gegeben und erläutert werden. Das Ausführungsbeispiel bezieht sich auf ein Kommunikationssystem, bei dessen durch die Datenverbindung miteinander verbundenen Endpunkten es sich um Netzwerkknoten innerhalb eines Netzwerks handelt. Auf die Darstellung der Verbindungen/Konnektivitäten dieser beiden Netzwerkknoten zu anderen Netzwerkknoten des Netzwerks wurde dabei verzichtet.The following is based on the 1 given an embodiment of the invention and explained. The exemplary embodiment relates to a communication system in which the end points connected to one another by the data connection are network nodes within a network. The connections/connectivities of these two network nodes to other network nodes of the network were not shown.

Die Fig. 1 zeigt eine grobschematische Darstellung des durch zwei Netzwerkknoten (erster Endpunkt 1 und zweiter Endpunkt 2) und eine diese untereinander verbindende Datenverbindung 3 ausgebildeten Kommunikationssystems. Beide Netzwerkknoten (Endpunkte 1, 2) weisen jeweils einen Verschlüsseler 4, 5 auf, das heißt eine Ver- und Entschlüsselungseinrichtung für einen über die Datenverbindung zwischen den Netzwerkknoten (Endpunkten 1, 2) erfolgenden verschlüsselten Datenverkehr. Erfindungsgemäß sind den Verschlüsselern 4, 5 beider Netzwerkknoten (Endpunkte 1, 2) jeweils ein PQC-Server, ein lokaler Schlüsselspeicher 6, 7 zur Aufnahme gemeinsamer, das heißt in beiden Netzwerkknoten (Endpunkten 1, 2) identisch vorliegender Quantenschlüssel, und ein lokales Schlüsselmanagement 8, 9 zur Verwaltung der vorgenannten Quantenschlüssel zugeordnet oder wahlweise auch als integraler Bestandteil des jeweiligen Verschlüsselers 4, 5 ausgebildet.The 1 shows a rough schematic representation of the communication system formed by two network nodes (first endpoint 1 and second endpoint 2) and a data link 3 connecting them to one another. Both network nodes (endpoints 1, 2) each have an encryptor 4, 5, ie an encryption and decryption device for encrypted data traffic taking place via the data connection between the network nodes (endpoints 1, 2). According to the invention, the encryptors 4, 5 of both network nodes (endpoints 1, 2) each have a PQC server, a local key memory 6, 7 for receiving common quantum keys, i.e. identical quantum keys in both network nodes (endpoints 1, 2), and local key management 8, 9 assigned to the management of the aforementioned quantum key or alternatively designed as an integral part of the respective encryptor 4, 5.

In einem Komfortbetrieb, bei dem es sich insbesondere bei einem als Teil eines Kernnetzes ausgebildeten Kommunikationssystems auch um einen Regelbetrieb handeln kann, verschlüsseln die Netzwerkknoten (Endpunkten 1, 2) die zwischen ihnen übertragenen Nutzdaten mittels eines Schlüssels, der durch eine bitweise XOR-Verknüpfung eines zuvor mittels eines PQC-Verschlüsselungsverfahrens zwischen ihnen ausgetauschten Basisschlüssels mit einem (in beiden Netzwercknoten, das heißt Endpunkten 1, 2, identisch verwendeten) Quantenschlüssel des gemeinsamen Vorrats beider Netzwerkknoten erzeugt wird.In comfort operation, which can also be regular operation, in particular in the case of a communication system designed as part of a core network, the network nodes (endpoints 1, 2) encrypt the user data transmitted between them using a key which, by means of a bit-by-bit XOR link of a previously exchanged between them by means of a PQC encryption method with a quantum key (used identically in both network nodes, ie endpoints 1, 2) is generated from the shared store of both network nodes.

Solange die Systeme zur Erzeugung von durch die beiden Netzwerkknoten (Endpunkte 1, 2) als gemeinsame Schlüssel zu verwendenden Quantenschlüsseln einwandfrei, das heißt ohne technische Störung oder Detektion eines möglichen Angriffs, arbeiten und in beiden Netzwerkknoten genügend Quantenschlüssel zur Verfügung stehen, arbeitet das Kommunikationssystem in diesem Komfortbetrieb oder Regelbetrieb. Tritt jedoch eine irgendwie geartete Störung der die Quantenschlüssel erzeugenden Systeme auf, so fällt das Kommunikationssystem unmittelbar in den Basisbetrieb zurück. Hierbei wird zur Verschlüsselung der zwischen den Netzwerkknoten (Endpunkten 1, 2) ausgetauschten Daten ausschließlich der jeweils gültige Basisschlüssel verwendet. Letzterer wird durch die beiden Netzwerkknoten (Endpunkte 1, 2) jeweils zuvor nach einem Public-Key-Verfahren, jedoch vorliegend nach einem besonders sicheren Verfahren, nämlich nach einem PQC-Verschlüsselungsverfahren, ausgetauscht. Der Austausch vollzieht sich hierbei wie folgt.As long as the systems for generating quantum keys to be used as shared keys by the two network nodes (endpoints 1, 2) work properly, i.e. without technical faults or detection of a possible attack, and sufficient quantum keys are available in both network nodes, the communication system works in this comfort mode or control mode. However, if the systems generating the quantum keys are disrupted in any way, the communication system immediately falls back into basic operation. In this case, only the currently valid basic key is used to encrypt the data exchanged between the network nodes (endpoints 1, 2). The latter is exchanged beforehand by the two network nodes (endpoints 1, 2) using a public key method, but in the present case using a particularly secure method, namely a PQC encryption method. The exchange takes place as follows.

Der erste Netzwerkknoten (Endpunkt 1) möchte mit dem zweiten Netzwerkknoten (Endpunkt 2) Nutzdaten auf einem der Layer 1, 2 oder 3 des OSI-Schichtenmodels austauschen. Hierzu identifizieren sich die beiden Netzwerkknoten, das heißt deren Systeme, zunächst untereinander durch den Einsatz eines PQC-Signaturverfahrens. Nach erfolgreicher Authentifizierung verschlüsselt der erste Netzwerkknoten (Endpunkt 1) eine bei ihm erzeugte Zufallszahl mit dem früher erhaltenen öffentlichen Schlüssel des zweiten Netzwerkknotens (Endpunkt 2) und überträgt die entstehende Bitsequenz über die Datenverbindung 3 an den zweiten Netzwerkknoten (Endpunkt 2). Der zweite Netzwerkknoten (Endpunkt 2) extrahiert aus der von ihm empfangenen Bitsequenz mittels seines privaten Schlüssels die durch den ersten Netzwerkknoten (Endpunkt 1) erzeugte, als Shared Secret übertragene Zufallszahl. Beide Netzwerkknoten, das heißt Endpunkte 1, 2, verfügen nun über dieselbe geheime Zufallszahl, welche sie als Basisschlüssel verwenden. Befindet sich das Kommunikationssystem aufgrund einer Störung bei der Erzeugung der Quantenschlüssel im Basisbetrieb, so wird der wie vorstehend übertragene Basisschlüssel zur symmetrischen Verschlüsselung der zu übertragenden Nutzdaten verwendet.The first network node (endpoint 1) would like to exchange user data with the second network node (endpoint 2) on one of layers 1, 2 or 3 of the OSI layer model. To do this, the two network nodes, i.e. their systems, first identify themselves with one another by using a PQC signature process. After successful authentication, the first network node (endpoint 1) encrypts a random number generated by it with the public key of the second network node (endpoint 2) received earlier and transmits the resulting bit sequence via data connection 3 to the second network node (endpoint 2). The second network node (endpoint 2) uses its private key to extract the random number generated by the first network node (endpoint 1) and transmitted as a shared secret from the bit sequence it has received. Both network nodes, ie endpoints 1, 2, now have the same secret random number, which they use as the base key. If the communication system is in basic operation due to a fault in the generation of the quantum key, the basic key transmitted as above is used for the symmetrical encryption of the user data to be transmitted.

Andernfalls - das Kommunikationssystem arbeitet im Komfortbetrieb - wird dieser Basisschlüssel mittels eines Quantenschlüssels aus dem gemeinsamen Vorrat beider Netzwerkknoten (Endpunkte 1, 2) bitweise XOR-verknüpft und die hierbei entstehende Bitsequenz zur symmetrischen Verschlüsselung zwischen den Netzwerkknoten (Endpunkten 1, 2) zu übertragender Nutzdaten verwendet. Vorzugsweise zusammen mit dem Basisschlüssel überträgt dazu der erste Netzwerkknoten (der erste Endpunkt 1) einen Identifier desjenigen Quantenschlüssels aus dem gemeinsamen Vorrat, den er zur bitweisen XOR-Verknüpfung des Basisschlüssels verwenden will, an den zweiten Netzwerkknoten (an den zweiten Endpunkt 2). Mit Hilfe des mit übertragenen Identifiers sucht der zweite Netzwerkknoten (Endpunkt 2), gesteuert durch sein lokales Schlüsselmanagement 9, den mit diesem bezeichneten, bei ihm ebenfalls vorliegenden Quantenschlüssel aus dem lokalen Schlüsselspeicher 7 heraus und verknüpft diesen seinerseits mittels des Verschlüsselers 5 bitweise XOR mit dem zuvor von ihm aus den vom ersten Netzwerkknoten empfangenen Daten extrahierten Basisschlüssel.Otherwise - the communication system is working in comfort mode - this basic key is XORed bit by bit using a quantum key from the common stock of both network nodes (endpoints 1, 2) and the resulting bit sequence for symmetric encryption between the network nodes (endpoints 1, 2) of user data to be transmitted used. Preferably together with the base key, the first network node (the first endpoint 1) transmits to the second network node (the first endpoint 2) an identifier of that quantum key from the shared store that it wants to use for bitwise XORing of the base key. With the help of the transmitted identifier, the second network node (endpoint 2), controlled by its local key management 9, searches for the quantum key designated by it, which is also available to it, from the local key memory 7 and, in turn, uses the encryptor 5 to XOR it bit by bit with the previously extracted by him from the data received from the first network node base key.

Die zuvor angesprochenen Verfahren zur PQC-Verschlüsselung beziehungsweise zur Authentifizierung (PQC-Signaturverfahren) sind als solches bereits bekannt und, wenngleich möglicherweise bisher nur in theoretischen Abhandlungen veröffentlicht, als Stand der Technik anzusehen. Sie sind insoweit nicht Teil der hier vorliegenden Erfindung und sollen daher auch nicht näher erläutert werden. Daher soll nachfolgend lediglich eine Übersicht zu den insoweit bekannten Verfahren gegeben werden.The above-mentioned methods for PQC encryption or authentication (PQC signature method) are already known as such and, although they may have only been published in theoretical papers to date, are to be regarded as state of the art. In this respect, they are not part of the present invention and should therefore not be explained in any more detail. Therefore, only an overview of the methods known in this respect will be given below.

Verfügbare Post Quantum VerschlüsselungsverfahrenAvailable Post Quantum encryption methods

'BIKE1-L1-CPA', 'BIKE1-L3-CPA', 'BIKE1-L1-FO', 'BIKE1-L3-FO', 'Kyber512', 'Kyber768', 'Kyber1024', 'Kyber512-90s', 'Kyber768-90s', 'Kyber1024-90s', 'LEDAcryptKEM-LT12', 'LEDAcryptKEM-LT32', 'LEDAcryptKEM-LT52', 'NewHope-512-CCA', 'NewHope-1024-CCA', 'NTRU-HPS-2048-509', 'NTRU-HPS-2048-677', 'NTRU-HPS-4096-821', 'NTRU-HRSS-701', 'LightSaber-KEM', 'Saber-KEM', 'FireSaber-KEM', 'BabyBear', 'BabyBearEphem', 'MamaBear', 'MamaBearEphem', 'PapaBear', 'PapaBearEphem', ,FrodoKEM-640-AES', 'FrodoKEM-640-SHAKE', 'FrodoKEM-976-AES', 'FrodoKEM-976-SHAKE', 'FrodoKEM-1344-AES', 'FrodoKEM-1344-SHAKE', 'SIDH-p434', 'SIDH-p503', 'SIDH-p610', SIDH-p751', 'SIDH-p434-compressed', 'SIDH-p503-compressed', 'SIDH-p610-compressed', 'SIDH-p751-compressed', 'SIKE-p434', 'SIKE-p503', 'SIKE-p610', 'SIKE-p751', 'SIKE-p434-compressed', 'SIKE-p503-compressed', 'SIKE-p610-compressed', 'SIKE-p751 -compressed'.'BIKE1-L1-CPA', 'BIKE1-L3-CPA', 'BIKE1-L1-FO', 'BIKE1-L3-FO', 'Kyber512', 'Kyber768', 'Kyber1024', 'Kyber512-90s', 'Kyber768-90s', 'Kyber1024-90s', 'LEDAcryptKEM-LT12', 'LEDAcryptKEM-LT32', 'LEDAcryptKEM-LT52', 'NewHope-512-CCA', 'NewHope-1024-CCA', 'NTRU-HPS -2048-509', 'NTRU-HPS-2048-677', 'NTRU-HPS-4096-821', 'NTRU-HRSS-701', 'LightSaber-KEM', 'Saber-KEM', 'FireSaber-KEM ', 'BabyBear', 'BabyBearEphem', 'MamaBear', 'MamaBearEphem', 'PapaBear', 'PapaBearEphem', ,FrodoKEM-640-AES', 'FrodoKEM-640-SHAKE', 'FrodoKEM-976-AES', 'FrodoKEM-976-SHAKE', 'FrodoKEM-1344-AES ', 'FrodoKEM-1344-SHAKE', 'SIDH-p434', 'SIDH-p503', 'SIDH-p610', SIDH-p751', 'SIDH-p434-compressed', 'SIDH-p503-compressed', 'SIDH-p610-compressed','SIDH-p751-compressed','SIKE-p434','SIKE-p503','SIKE-p610','SIKE-p751','SIKE-p434-compressed','SIKE-p503-compressed','SIKE-p610-compressed','SIKE-p751-compressed'.

Verfügbare Post Quantum Signaturverfahren:Available Post Quantum signature schemes:

'DILlTHIUM_2', 'DILITHIUM_3', 'DILITHIUM_4', 'MQDSS-31-48', MQDSS-31-64', SPHINCS+-Haraka-128f-robust', SPHINCS+-Haraka-128f-simple', 'SPHINCS+-Haraka-128s-robust', 'SPHINCS+-Haraka-128s-simple', 'SPHINCS+-Haraka-192f-robust', 'SPHINCS+-Haraka-192f-simple', 'SPHINCS+-Haraka-192s-robust', 'SPHINCS+-Haraka-192s-simple', 'SPHINCS+-Haraka-256f-robust', 'SPHINCS+-Haraka-256f-simple', 'SPHINCS+-Haraka-256s-robust', 'SPHINCS+-Haraka-256s-simple', 'SPHINCS+-SHA256-128f-robust', ,SPHINCS+-SHA256-128f-simp-le', 'SPHINCS+-SHA256-128s-robust', 'SPHINCS+-SHA256-128s-simple', 'SPHINCS+-SHA256-192f-robust', 'SPHINCS+-SHA256-192f-simple', 'SPHINCS+-SHA256-192s-robust', 'SPHINCS+-SHA256-192s-simple', 'SPHINCS+-SHA256-256f-robust', 'SPHINCS+-SHA256-256f-simple', 'SPHINCS+-SHA256-256s-robust', 'SPHINCS+-SHA256-256s-simple', 'SPHINCS+-SHAKE256-128f-robust', 'SPHINCS+-SHAKE256-128f-simple', 'SPHINCS+-SHAKE256-128s-robust', 'SPHINCS+-SHAKE256-128s-simple', 'SPHINCS+-SHAKE256-192f-robust', 'SPHINCS+-SHAKE256-192f-simple', 'SPHINCS+-SHAKE256-192s-robust', 'SPHINCS+-SHAKE256-192s-simple', 'SPHINCS+-SHAKE256-256f-robust', 'SPHINCS+-SHAKE256-256f-simple', 'SPHINCS+-SHAKE256-256s-robust', 'SPHINCS+-SHAKE256-256s-simple',m 'picnic L1_FS', 'picnic_L1_UR', 'picnic_L3_FS', 'picnic_L3_UR', 'picnic_L5_FS', 'picnic_L5_UR', 'picnic2_L1_FS', 'picnic2_L3_FS', 'picnic2_L5_FS', 'qTesla-p-I', 'qTesla-p-III''DILlTHIUM_2', 'DILITHIUM_3', 'DILITHIUM_4', 'MQDSS-31-48', MQDSS-31-64', SPHINCS+-Haraka-128f-robust', SPHINCS+-Haraka-128f-simple', 'SPHINCS+-Haraka- 128s-robust', 'SPHINCS+-Haraka-128s-simple', 'SPHINCS+-Haraka-192f-robust', 'SPHINCS+-Haraka-192f-simple', 'SPHINCS+-Haraka-192s-robust', 'SPHINCS+-Haraka- 192s-simple', 'SPHINCS+-Haraka-256f-robust', 'SPHINCS+-Haraka-256f-simple', 'SPHINCS+-Haraka-256s-robust', 'SPHINCS+-Haraka-256s-simple', 'SPHINCS+-SHA256- 128f-robust', ,SPHINCS+-SHA256-128f-simple', 'SPHINCS+-SHA256-128s-robust', 'SPHINCS+-SHA256-128s-simple', 'SPHINCS+-SHA256-192f-robust', 'SPHINCS+- SHA256-192f-simple', 'SPHINCS+-SHA256-192s-robust', 'SPHINCS+-SHA256-192s-simple', 'SPHINCS+-SHA256-256f-robust', 'SPHINCS+-SHA256-256f-simple', 'SPHINCS+- SHA256-256s-robust', 'SPHINCS+-SHA256-256s-simple', 'SPHINCS+-SHAKE256-128f-robust', 'SPHINCS+-SHAKE256-128f-simple', 'SPHINCS+-SHAKE256-128s-robust', 'SPHINCS+- SHAKE256-128s-simple', 'SPHINCS+-SHAKE256-192f-robust', 'SPHINCS+-SHAKE256-192f-simple', 'SPHINCS+-SHAKE256-192s-robust', 'SPHINCS+-SHAKE256-192s-simple', 'SPHINCS+- SHAKE256-256f-robust', 'SPHINCS+-SHAKE256-256f-simple', 'SPHINCS+-SHAKE256-256s-robust', 'SPHINCS+-SHAKE256-256s-simple',m 'picnic L1_FS', 'picnic_L1_UR', 'picnic_L3_FS' , 'picnic_L3_UR', 'picnic_L5_FS', 'picnic_L5_UR', 'picnic2_L1_FS', 'picnic2_L3_FS', 'picnic2_L5_FS', 'qTesla-p-I', 'qTesla-p-III'

Standardisierung der Systeme und Schnittstellen zum QuantenschlüsselaustauschStandardization of systems and interfaces for quantum key exchange

Das hier vorgestellte Verfahren nutzt die Standards und Verfahren, die in den jeweiligen nationalen und internationalen Standardisierungsgremien erarbeitet werden. Diese sind:

  • National Standardization (NIST, IEEE)
  • European Standardization (ETSI ISG QKD, ETSI TC Cyber WG QSC)
  • Internationale Standardization (ISO /IEC, ITU, Quantum Internet Proposed Research Groupd, Crypto Forum Focus Group)
The procedure presented here uses the standards and procedures that are developed in the respective national and international standardization committees. These are:
  • National Standardization (NIST, IEEE)
  • European Standardization (ETSI ISG QKD, ETSI TC Cyber WG QSC)
  • International standardization (ISO /IEC, ITU, Quantum Internet Proposed Research Groupd, Crypto Forum Focus Group)

Die Integration von QKD-Netzen, insbesondere Metro-Netzen, mit PQC Netzwerkbrücken über 5G, Fiber oder Satellitenverbindungen über klassische Satelliten wird in diesen Gremien (noch) nicht diskutiert.The integration of QKD networks, especially metro networks, with PQC network bridges via 5G, fiber or satellite connections via classic satellites is not (yet) discussed in these committees.

Technische Realisierungtechnical realization

  • QKD-Systeme werden bereits auf dem Markt durch mehrere Firmen angeboten.QKD systems are already available on the market from several companies.
  • Verschlüsseler werden passend zu den QKD-Systemen angeboten.Encryptors are offered to match the QKD systems.
  • Key Store Systeme, das heißt Schlüsselspeicher werden ebenfalls bereits von mehreren Firmen angeboten.Key store systems, ie key stores, are also already being offered by a number of companies.
  • Key Management Systeme (Systeme für das Schlüsselmanagement) werden von den QKD-Anbietern passend zu ihren Systemen angeboten. Ein anbieterunabhängiges, providerspezifisches Schlüsselmanagement ist abhängig von den laufenden Standardisierungsbemühungen und zurzeit noch nicht erhältlich.Key management systems (systems for key management) are offered by the QKD providers to match their systems. A provider-independent, provider-specific key management depends on the ongoing standardization efforts and is not yet available.
  • PQC-Signatur- und Verschlüsselungsalgorithmen sind in Form von "open source Bibliotheken" verfügbar. Diese Bibliotheken bedürfen einer Adaption und eine Neukompilation von openssl, der zurzeit gängigsten Krypto-Bibliothek. Die Verfahren haben einen Stand, der es ermöglicht, dass die angewandte Forschung und Entwicklung sie benutzen kann - eine Marktreife liegt noch nicht vor.PQC signature and encryption algorithms are available in the form of "open source libraries". These libraries require an adaptation and a recompilation of openssl, currently the most common crypto library. The processes are at a level that makes it possible for applied research and development to use them - they are not yet ready for the market.
  • AES 256 zur quantensicheren Verschlüsselung von Nutzdaten, ist standardisiert und Teil gängiger Programmierumgebungen.AES 256 for quantum secure encryption of user data is standardized and part of common programming environments.
  • PQ-PKI (Public Key Infrastrukturen) zum Enrollment und zur Verifikation von hybriden PQ-Zertifikaten liegen als Test Implementierungen und Internetservices vor.PQ-PKI (Public Key Infrastructures) for enrollment and verification of hybrid PQ certificates are available as test implementations and internet services.
Verwendete Abkürzungen:Used abbreviations:

AESAES
Advanced Encryption StandardAdvanced Encryption Standard
KEMKEM
Key Encapsulation MechanismKey Encapsulation Mechanism
OSIOSI
Open Systems InterconnectionOpen Systems Interconnection
OTNOTN
Optical Transport NetworkOptical Transport Network
PKIPKI
Public Key InfrastructurePublic Key Infrastructure
PQpq
Post Quantumpost-quantum
PQCPQC
Post Quantum CryptographyPost-quantum cryptography
QKDQKD
Quantum Key DistributionQuantum Key Distribution
QRNGQRNG
Quantum Ranfom Number GeneratorQuantum Random Number Generator
RSARSA
Rivest-Shamir-Adleman AlgorithmusRivest-Shamir-Adleman Algorithm
SIGSIG
SignatureSignature
SSLSSL
Secure Sockets LayerSecure Sockets Layer

Claims (12)

  1. Method for operating a communication system, consisting of two endpoints (1, 2) and a data connection (3) between these endpoints (1, 2), in which payload data interchanged between the first endpoint (1) and the second endpoint (2) of the communication system are symmetrically encrypted by means of a key that is present in both endpoints (1, 2) and that is based on a random number generated in the first endpoint (1) and transmitted to the second endpoint (2) as a shared secret using the public key principle, characterized in that in a basic mode of the communication system the random number interchanged between the endpoints (1, 2) using the public key method, which random number represents a basic key, is used directly to symmetrically encrypt the payload data, whereas in a comfort mode, specifically in a mode with increased security for the encryption of the payload data, the symmetrical encryption of the payload data is carried out by means of a key that is formed by way of a bit-by-bit XORing of the basic key with an additional key, which is present in both endpoints (1, 2) and is a quantum key, that is to say a key generated using a quantum-safe method, wherein the communication system, in the event of its being used in the comfort mode and a fault occurring, reverts to the basic mode in automated fashion.
  2. Method according to Claim 1, characterized in that it is used in a communication system in which the endpoints (1, 2) connected to one another by the data connection are two network nodes in a network.
  3. Method according to Claim 1 or 2, characterized in that the additional key used for the bit-by-bit XORing with the basic key is one of multiple quantum keys present in both endpoints (1, 2), wherein in the comfort mode an identifier that explicitly denotes the quantum key to be used for the bit-by-bit XORing is transmitted between the two endpoints (1, 2), preferably together with the shared secret transmitted using the public key method.
  4. Method according to one of Claims 1 to 3, characterized in that the first endpoint (1) generates the random number transmitted to the second endpoint (2) as a shared secret, and forming the basic key, by means of a quantum random number generator QRNG.
  5. Method according to one of Claims 1 to 4, characterized in that the public key method used for transmitting the random number transmitted as a shared secret, and forming the basic key, is a PQC encryption method.
  6. Method according to Claim 5, characterized in that the two endpoints (1, 2) of the communication system authenticate themselves to one another using a PQC signature method before the shared secret is transmitted using the PQC encryption method.
  7. Method according to one of Claims 1 to 6, characterized in that the quantum key used as the additional key, and used for the bit-by-bit XORing with the basic key, is generated by the two endpoints (1, 2), which are of appropriate design for that purpose, together using a QKD method.
  8. Method according to one of Claims 1 to 6, wherein the two endpoints (1, 2) of the communication system are not in a QKD relationship with one another, but are each connected to two other endpoints, which form a QKD group, via at least two completely disjunct connecting paths, characterized in that the quantum key used as the additional key is made available to the two endpoints (1, 2) of the communication system by the QKD group by means of a transmission method in which the QKD group transmits multiple bit sequences formed by way of bit-by-bit XORing of quantum keys generated by the QKD group, at least one of which bit sequences is formed with the involvement of the additional key, to the two endpoints (1, 2) of the communication system via one of the disjunct connecting paths each, and the endpoints of the communication network extract the quantum key to be used by them as the additional key for the bit-by-bit XORing with the basic key by way of bit-by-bit XORing of the bit sequences arriving at them from the QKD group.
  9. Communication system, consisting of two endpoints (1, 2) and a data connection (3) connecting the two endpoints (1, 2) to one another, wherein
    - both endpoints (1, 2) are designed to transmit payload data interchanged via the data connection (3) in encrypted form, for which purpose each of the endpoints (1, 2) has an encryptor (4, 5), that is to say has an encryption and decryption device, and
    - both endpoints (1, 2) have a joint stock of quantum keys, the keys of which each of the two endpoints (1, 2) holds in a local key memory (6, 7) and manages by means of a local key management (8, 9), and
    - at least one first endpoint (1) of the two endpoints (1) is designed to generate random numbers to be used as basic keys and, in order to transmit these basic keys to the second endpoint (2), using the public key principle, has a public key of the second endpoint (2), for which a secret key corresponding to this public key exists that is in the possession of the second endpoint (2),
    characterized in that
    a.) the encryptors (4, 5) of both endpoints (1, 2) are each equipped with a PQC server for carrying out a PQC encryption method and with a unit for the bit-by-bit XORing of bit sequences,
    b.) the communication system can be operated in a basic mode and in a comfort mode, and in each of the two operating modes the payload data interchanged between the endpoints (1, 2) are symmetrically encrypted using a basic key that is interchanged between the endpoints (1, 2) using a PQC encryption method carried out by their PQC servers, wherein encrypting the payload data in the basic mode involves using the basic key directly and in the comfort mode involves using a key that is generated by the endpoints (1, 2) by means of their respective unit provided for that purpose by way of bit-by-bit XORing of the basic key with an identical quantum key taken from their joint stock,
    c.) the communication system reverts to the basic mode in automated fashion in the event of its being used in the comfort mode and a fault occurring.
  10. Communication system according to Claim 9, characterized in that the endpoints (1, 2) thereof that are connected to one another by the data connection (3) are two network nodes in a network.
  11. Communication system according to Claim 9 or 10, characterized in that the two endpoints (1, 2) of the communication system have a QKD system and are in a QKD relationship with one another for the purpose of generating the quantum keys used as additional keys using a QKD method, that is to say using a quantum key distribution method.
  12. Communication system according to one of Claims 9 to 11, characterized in that the first endpoint (1) thereof has a quantum random number generator QRNG in order to generate the random numbers to be used as basic keys.
EP20191225.0A 2020-08-14 2020-08-14 Communication system with multi-stage security concept Active EP3955510B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP20191225.0A EP3955510B1 (en) 2020-08-14 2020-08-14 Communication system with multi-stage security concept

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP20191225.0A EP3955510B1 (en) 2020-08-14 2020-08-14 Communication system with multi-stage security concept

Publications (2)

Publication Number Publication Date
EP3955510A1 EP3955510A1 (en) 2022-02-16
EP3955510B1 true EP3955510B1 (en) 2023-04-19

Family

ID=72088027

Family Applications (1)

Application Number Title Priority Date Filing Date
EP20191225.0A Active EP3955510B1 (en) 2020-08-14 2020-08-14 Communication system with multi-stage security concept

Country Status (1)

Country Link
EP (1) EP3955510B1 (en)

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8862866B2 (en) * 2003-07-07 2014-10-14 Certicom Corp. Method and apparatus for providing an adaptable security level in an electronic communication
EP2890084B1 (en) * 2013-12-31 2018-04-18 Thales Nederland B.V. A data securing system and method
DE102014212219A1 (en) * 2014-06-25 2015-12-31 Robert Bosch Gmbh Method for authentication and connection of a device to a network and network participants established for this purpose
DE102016112278A1 (en) * 2016-07-05 2018-01-11 Media Transfer Ag Method for establishing a failover in a network

Also Published As

Publication number Publication date
EP3955510A1 (en) 2022-02-16

Similar Documents

Publication Publication Date Title
DE69633709T2 (en) Installation for the encryption and decryption of data transmitted in ATM cells
EP2036242B1 (en) Hub device for a network comprising quantum cryptographic connections and node module for said hub device
DE3919734C1 (en)
DE102012111903B4 (en) Method for establishing a secure connection between clients
EP3516842B1 (en) Method and device for transferring data in a topic-based publish-subscribe system
WO2019145207A1 (en) Method and system for disclosure of at least one cryptographic key
EP3157192A1 (en) Method and system for asymmetric key derivision
EP3059895A1 (en) One-off encryption of counter data
WO2021224392A1 (en) Provision of quantum-safe keys for network nodes not connected to one another by a quantum channel
EP3955510B1 (en) Communication system with multi-stage security concept
EP4099611B1 (en) Generation of quantum secure keys in a network
EP3955508A1 (en) Exchange of quantum secure keys between local area networks
DE102006003167B3 (en) Real-time communication protecting method for e.g. automation system, involves producing and managing code in discrete device for protecting real-time communication that takes place by protecting unit in connection layer of reference model
EP2685696A1 (en) Method for the reliable operation of grids, in particular of wind farm or other extended networks
DE102016218758B4 (en) DEVICE AND METHOD FOR THE CONTINUOUS AND CROSS-MEDIA TRANSFER OF COMMUNICATION PROTOCOLS WITHOUT PROTOCOL IMPLEMENTATION
EP0632616A1 (en) Data security method in a B-ISDN telecommunications system
DE102006036165B3 (en) Method for establishing a secret key between two nodes in a communication network
EP3955511B1 (en) Secure data transmission within a qkd network node
EP3955509A1 (en) Provision of quantum keys in a network
EP3955512B1 (en) Transmission of quantum secure keys over intermediate network nodes
EP2547034B1 (en) Method and device for secure data transfer
EP2830277B1 (en) Method and system for tamper-proof transmission of data packets
EP4109810B1 (en) Incorporation of mobile radio network based communication devices into an infrastructure for providing quantum secure keys
DE102020204023A1 (en) Data transmission method and communication system
EP4254853A1 (en) End-to-end encrypted data transmission and protection of the last mile

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20220722

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20221116

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 502020003017

Country of ref document: DE

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: GERMAN

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1562009

Country of ref document: AT

Kind code of ref document: T

Effective date: 20230515

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20230419

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230821

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230719

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230819

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230720

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20230822

Year of fee payment: 4

Ref country code: FR

Payment date: 20230821

Year of fee payment: 4

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 502020003017

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

26N No opposition filed

Effective date: 20240122

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230814

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230814

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230831

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20230831

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230419